Medium severity · published Jan 20, 2026
CVE-2025-15043
The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration', and 'revert_migration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with subscriber level access and above, to start, cancel, or revert the Custom Tables V1 database migration, including dropping the custom database tables entirely via the revert action.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
The Events Calendar · stellarwp
through 6.15.13 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15043
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15043
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?old_path=/the-events-calendar/tags/6.15.13&new_path=/the-events-calendar/tags/6.15.13.1
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/346a5b00-fb76-4413-a935-a2df4dc51984?source=cve
More from The Events Calendar
9.8
CVE-2026-78159
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
9.8
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
9.8
CVE-2024-8275
The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection
9.1
CVE-2024-4180
The Events Calendar < 6.4.0.1 - Reflected XSS
7.5
CVE-2026-3585
The Events Calendar <= 6.15.17 - Authenticated (Author+) Arbitrary File Read via ajax_create_import