This vulnerability (CVE-2025-69135) is an SQL Injection issue classified under CWE-89 in the Events Schedule - WordPress Events Calendar Plugin for WordPress, specifically affecting versions up to 2.7.2. The injection occurs because the plugin fails to properly neutralize special elements used in SQL commands, allowing an attacker with subscriber privileges to execute crafted SQL queries. The CVSS v3.1 base score is 8.5, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with subscriber privileges can exploit this vulnerability to perform SQL Injection attacks, potentially leading to unauthorized disclosure of sensitive information (high confidentiality impact). The availability impact is low, and integrity is not affected. This could compromise the confidentiality of the WordPress site database managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting subscriber privileges or disabling the plugin if possible to reduce risk. Monitor official CurlyThemes communications for updates on patches or mitigations.