CVE-2025-12898 is a missing authorization vulnerability in the Pretty Google Calendar WordPress plugin by lbell. The issue arises because the pgcal_ajax_handler() function does not perform capability checks, enabling unauthenticated users to retrieve the Google API key stored in the plugin's settings. This vulnerability affects all versions up to and including 2.0.0. The CVSS 3.1 score is 5.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impacts confidentiality only. No patch or official fix has been documented in the provided information.

An attacker can retrieve the Google API key from the plugin settings without authentication. This exposure could potentially allow unauthorized use of the Google API key, which may lead to abuse of the associated Google services or quota. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's AJAX handlers or disabling the plugin if the API key exposure risk is unacceptable. Monitor vendor channels for updates and apply patches promptly once available.