What is the CVSS score of CVE-2025-67592?

CVE-2025-67592 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

My Calendar CVE-2025-67592

Q: Which versions of My Calendar are affected by CVE-2025-67592?

Authenticated low-privilege users can modify calendar data in My Calendar WordPress plugin versions <= 3.6.16 due to missing authorization checks, allowing unauthorized integrity impact.

MEDIUM

Missing Authorization (CWE-862)

2025-12-09 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Low-privileged attacker can reliably perform unauthorized modification over the network without any confidentiality or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:29 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.

AnalysisAI

Authenticated low-privilege users can modify calendar data in My Calendar WordPress plugin versions <= 3.6.16 due to missing authorization checks, allowing unauthorized integrity impact. The flaw has a CVSS score of 4.3, very low exploitation probability (EPSS 0.05%), and no known active exploitation or public exploit code at time of analysis.

Technical ContextAI

The vulnerability resides in the My Calendar plugin for WordPress, which fails to enforce proper capability verification for certain actions (CWE-862 Missing Authorization). The plugin's PHP code likely omits a permission check before processing requests, enabling users with limited roles (e.g., subscriber) to invoke functionality intended for higher privileges. The affected endpoint is not explicitly disclosed, but the Patchstack advisory confirms the issue stems from incorrectly configured access control security levels. No specific CPE strings are provided, though the plugin slug 'my-calendar' is referenced in the advisory URL.

Affected ProductsAI

My Calendar WordPress plugin versions up to and including 3.6.16. The exact version range is confirmed by the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/my-calendar/vulnerability/wordpress-my-calendar-plugin-3-6-16-broken-access-control-vulnerability?_s_id=cve. No official CPE is listed, but the advisory URL contains the plugin slug.

RemediationAI

Upgrade to My Calendar version 3.6.17 or later once released by the developer. The Patchstack advisory may provide the exact patched version; check the reference URL for updates. If an immediate update is not possible, consider disabling the plugin until a fix is applied. Since the vulnerability requires authentication, ensure that user accounts are minimized and that low-trust roles (e.g., subscriber) are not given unnecessary capabilities. No generic workaround compensates for the missing authorization, so patching remains the sole reliable remedy.