Introduction
A single unauthenticated request can quietly expose sensitive event data, user credentials, and even payment information stored in a WordPress database. CVE-2025-12197 targets The Events Calendar, a plugin with over 700,000 active installations. That reach makes the vulnerability especially relevant to organizations that use WordPress for event management.
Technical information
CVE-2025-12197 is a blind SQL injection vulnerability in The Events Calendar plugin for WordPress, versions 6.15.1.1 through 6.15.9. It comes from insufficient escaping and the lack of prepared statements around the 's' parameter, which the plugin uses for search queries. The plugin's custom query logic does not sanitize or parameterize that input. It places the raw value of 's' directly into SQL statements, so an unauthenticated attacker can inject SQL code and change the structure of the query.
The injection is blind. The database does not return output to the attacker directly, so the attacker infers information from how the application behaves or how long it takes to respond. For example, an attacker might send a payload such as s=test' AND IF(SUBSTRING(user_login,1,1)='a',SLEEP(5),0) and measure the response delay to work out the first character of a username. The technique can extract sensitive data even when error messages are suppressed.
The vulnerability survived an earlier fix for CVE-2025-9807, which affected versions up to 6.15.1. That fix was incomplete. It left the core issue unresolved in later versions, and the same parameter stayed open to similar exploitation.
Affected systems and versions
- Product: The Events Calendar WordPress plugin
- Affected versions: 6.15.1.1 through 6.15.9
- Any WordPress installation with this plugin in the specified version range is vulnerable, regardless of configuration
Vendor security history
The Events Calendar (Modern Tribe) has had recurring security issues, including:
- CVE-2025-9807: SQL injection in versions up to 6.15.1
- CVE-2024-8275: Unauthenticated SQL injection in tribe_has_next_event()
- CVE-2024-6931: Unauthenticated stored XSS
- CVE-2024-5333: Authorization bypass
The vendor releases patches when issues are disclosed, but the repeat appearance of similar vulnerabilities indicates problems with its secure development and code review practices.
