CVE-2025-12407
CSRF Vulnerability in Events Manager Plugin Allows Location Deletion
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | events_manager | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Events Manager WordPress plugin (up to version 7.2.2.2). It occurs because the plugin does not properly validate nonces on the 'location_delete' action, allowing an attacker to trick an authenticated site administrator into performing a location deletion by clicking a malicious link, even though the attacker is unauthenticated.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to delete location entries in the Events Manager plugin by tricking an administrator into clicking a crafted link. This could lead to loss of important location data on the site, potentially disrupting event management and causing administrative inconvenience or data integrity issues.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Cross-Site Request Forgery (CSRF) on the 'location_delete' action in the Events Manager WordPress plugin. Detection can focus on monitoring for unexpected or unauthorized POST requests to the plugin's AJAX endpoint that include the 'location_delete' action parameter. Network or web server logs can be inspected for such requests, especially those originating from unauthenticated sources or unusual referrers. Specific commands depend on your environment, but for example, using grep on web server logs to find such requests: grep 'action=location_delete' /var/log/apache2/access.log or grep 'action=location_delete' /var/log/nginx/access.log. Additionally, monitoring for suspicious admin clicks or CSRF attempts may require web application firewall (WAF) rules or plugins that log admin actions. No explicit commands are provided in the resources. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Events Manager plugin to a version later than 7.2.2.2 where the vulnerability is fixed. The changeset referenced (3392395) introduces stricter access control and nonce validation to prevent unauthorized location deletions. If updating is not immediately possible, consider disabling the plugin or restricting access to the AJAX endpoints related to location management to trusted users only. Additionally, educating site administrators to avoid clicking on suspicious links can help prevent exploitation. Implementing a Web Application Firewall (WAF) to block forged requests targeting the 'location_delete' action can also mitigate risk. [2]