CVE-2025-12526 is a missing authorization vulnerability (CWE-862) in the Private Google Calendars WordPress plugin by michielve. The issue arises because the plugin fails to perform a capability check on the 'pgc_remove' action, enabling authenticated users with Subscriber-level privileges or above to reset plugin settings. This vulnerability affects all versions up to 20250811. The CVSS 3.1 base score is 4.3 (medium severity), reflecting low complexity and no user interaction required, but limited impact confined to integrity (unauthorized modification of plugin settings). No patch or vendor advisory is currently available, and the plugin is not a cloud service.

An attacker with at least Subscriber-level access to a WordPress site using the affected plugin can reset the Private Google Calendars plugin settings without authorization. This could disrupt plugin functionality or lead to configuration changes that may affect site behavior. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for unauthorized changes to plugin settings. Applying the principle of least privilege for user roles can help reduce risk.