{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12898", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-07T19:05:37.066Z", "datePublished": "2025-12-20T03:20:22.435Z", "dateUpdated": "2026-04-08T17:16:46.076Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:46.076Z"}, "affected": [{"vendor": "lbell", "product": "Pretty Google Calendar", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings."}], "title": "Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c15924-d430-48e3-9804-fa83605b9c24?source=cve"}, {"url": "https://wordpress.org/plugins/pretty-google-calendar/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3422453%40pretty-google-calendar&new=3422453%40pretty-google-calendar&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ahmad Salem"}], "timeline": [{"time": "2025-12-19T15:06:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-22T20:34:24.477002Z", "id": "CVE-2025-12898", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T20:34:27.998Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12898", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-22T20:34:24.477002Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T20:34:14.697Z"}}], "cna": {"title": "Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Ahmad Salem"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "lbell", "product": "Pretty Google Calendar", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-19T15:06:58.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c15924-d430-48e3-9804-fa83605b9c24?source=cve"}, {"url": "https://wordpress.org/plugins/pretty-google-calendar/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3422453%40pretty-google-calendar&new=3422453%40pretty-google-calendar&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:46.076Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12898", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:16:46.076Z", "dateReserved": "2025-11-07T19:05:37.066Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-20T03:20:22.435Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings."}], "id": "CVE-2025-12898", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-20T04:16:07.043", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3422453%40pretty-google-calendar&new=3422453%40pretty-google-calendar&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/pretty-google-calendar/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c15924-d430-48e3-9804-fa83605b9c24?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:41:57.162671+00:00", "value": {"mitigation_remediation": ["Update Pretty Google Calendar to the latest release that includes a capability check for the AJAX handler.", "If an update is not immediately available, remove the plugin or deactivate the AJAX functionality by editing the plugin code to reject non\u2011admin requests.", "Rotate or invalidate any Google API keys that may have been exposed as a precaution."], "summary": {"action": "Apply Patch", "impact": "Unauthorized disclosure of Google API key"}, "threat_synthesis": {"affected_systems": "All installations of the Pretty Google Calendar plugin v2.0.0 or earlier are affected. The plugin is distributed by lbell and is available through the WordPress plugin repository.", "description_and_impact": "The Pretty Google Calendar WordPress plugin up to version 2.0.0 contains a missing capability check in the pgcal_ajax_handler function, allowing any user to trigger the AJAX endpoint and read the stored Google API key. This provides attackers with a credential that can be used to access the user\u2019s Google Calendar data or impersonate the user in Google services. The weakness is classified as CWE\u2011862, reflecting an authorization error, and the CVSS score of 5.3 indicates moderate severity.", "risk_and_exploitability": "The exploit requires no special privileges; any unauthenticated visitor can invoke the vulnerable endpoint, so the attack vector is inferred as public. The low EPSS (<1%) suggests that this vulnerability is not commonly exploited in the wild. It is not listed in CISA\u2019s KEV catalog. Therefore the risk is primarily the exposure of an API key, which can lead to privacy and potentially service disruption if the key is abused. The CVSS score indicates a moderate impact that should be remediated promptly."}}}}, "created": "2025-12-21T21:12:30.070949+00:00", "updated": "2026-04-21T00:45:23.098207+00:00", "vendors": ["lbell", "lbell$PRODUCT$pretty_google_calendar", "wordpress", "wordpress$PRODUCT$wordpress"]}