CVE-2025-12175 is a missing authorization vulnerability in the The Events Calendar plugin for WordPress, affecting all versions up to and including 6.15.9. The vulnerability arises from the lack of a capability check on the 'tec_qr_code_modal' AJAX endpoint, which permits authenticated users with minimal privileges (Subscriber-level and above) to access draft event names and generate or view QR codes associated with those drafts. This exposure could lead to unauthorized disclosure of unpublished event information. The CVSS score of 4.3 reflects limited confidentiality impact without integrity or availability effects.

An attacker with authenticated access at Subscriber level or higher can view draft event names and generate/view QR codes for those drafts without proper authorization. This results in unauthorized disclosure of potentially sensitive unpublished event information. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unusual access patterns related to draft events. Avoid granting unnecessary privileges to authenticated users. Follow updates from the vendor (stellarwp) for an official patch or mitigation.