This vulnerability (CVE-2025-69135) is an SQL Injection issue classified under CWE-89 in the Events Schedule - WordPress Events Calendar Plugin by CurlyThemes. It affects versions up to 2.7.2 and allows an attacker with subscriber privileges to execute unauthorized SQL commands. The CVSS 3.1 base score is 8.5, reflecting network attack vector, low attack complexity, required privileges at the subscriber level, no user interaction, and a scope change with high confidentiality impact and low availability impact. No official patch or remediation level has been provided in the available data, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive data (high confidentiality impact) and partial disruption of service (low availability impact). The integrity impact is not affected. The attacker must have subscriber-level privileges, which limits the attack surface to authenticated users with limited permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is indicated, users should monitor the vendor's communications for updates. Until a patch is available, restricting subscriber privileges and applying principle of least privilege may reduce risk.