CVE-2025-15043 is a missing authorization vulnerability (CWE-862) in the The Events Calendar plugin for WordPress, affecting all versions up to and including 6.15.13. The plugin fails to enforce capability checks on the 'start_migration', 'cancel_migration', and 'revert_migration' functions. As a result, authenticated users with subscriber-level privileges or higher can manipulate the Custom Tables V1 database migration process, including the ability to drop custom database tables via the revert action. This can lead to denial of service or data loss. The CVSS 3.1 base score is 5.4, reflecting a medium severity impact with network attack vector, low attack complexity, and low privileges required.

The vulnerability allows authenticated users with minimal privileges (subscriber level and above) to interfere with the database migration process of the plugin. Specifically, they can start, cancel, or revert migrations, with the revert action capable of dropping custom database tables. This can cause data loss or service disruption related to the plugin's custom tables. There is no indication of confidentiality impact, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user capabilities where possible and monitor for suspicious activity related to migration functions. Avoid granting unnecessary privileges to low-level authenticated users. Follow updates from the plugin vendor for an official patch.