The vulnerability identified as CVE-2025-32299 affects Themovation QuickCal - Appointment Booking Calendar for WordPress plugin versions up to 1.0.15. It permits an attacker with limited privileges (PR:L) and no user interaction (UI:N) to retrieve embedded sensitive system information, exposing data confidentiality (C:L) without impacting integrity or availability. The attack vector is network-based (AV:N), and the vulnerability scope is unchanged (S:U). No official patch or vendor advisory is available at this time.

The vulnerability allows unauthorized users with limited privileges to access sensitive system information embedded within the QuickCal plugin. This exposure could aid attackers in further reconnaissance or targeted attacks but does not directly affect system integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the QuickCal plugin to trusted users only and monitor for unusual access patterns. Avoid granting unnecessary privileges to users of the plugin.