CVE-2025-14160
CSRF Vulnerability in Calendly WordPress Plugin Allows API Key Modification
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| calendly | plugin_for_wordpress | 1.2.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect the CVE-2025-14160 vulnerability on your system, you should check if the 'Upcoming for Calendly' WordPress plugin is installed and if its version is 1.2.4 or earlier, as these versions lack nonce verification on the settings update form. You can detect the plugin version via WordPress admin dashboard or by checking the plugin files. Additionally, you can look for the absence of nonce verification in the plugin's settings form submission handler. Since the vulnerability involves CSRF on the settings page updating the Calendly Access Token, monitoring for unexpected changes to the Access Token or suspicious POST requests to the plugin's settings URL without valid nonces can help detect exploitation attempts. Suggested commands include using WP-CLI to check the plugin version: `wp plugin list --status=active` and inspecting the plugin version. You can also use network monitoring tools to detect POST requests to the plugin's settings endpoint lacking proper nonce tokens. However, no specific commands for direct detection of exploitation are provided in the resources. [1, 2, 3, 4]
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Upcoming for Calendly plugin for WordPress, affecting all versions up to and including 1.2.4. It occurs because the plugin's settings update functionality lacks nonce validation, allowing an attacker to trick a site administrator into performing an unwanted action, such as updating the plugin's Calendly API key via a forged request.
How can this vulnerability impact me? :
An unauthenticated attacker can exploit this vulnerability to update the plugin's Calendly API key by tricking a site administrator into clicking a malicious link. This could lead to unauthorized changes in the plugin configuration, potentially disrupting service or redirecting data to an attacker-controlled API key.
What immediate steps should I take to mitigate this vulnerability?
Update the Upcoming for Calendly plugin for WordPress to a version later than 1.2.4 where the nonce validation issue is fixed. Until then, restrict administrative access and avoid clicking on suspicious links that could trigger forged requests.