CVE-2025-9808 is an information exposure vulnerability in the The Events Calendar WordPress plugin by stellarwp. The issue exists in all versions up to 6.15.2 and involves the REST endpoint leaking sensitive data related to password-protected vendors or venues. The vulnerability allows unauthenticated attackers to retrieve this information without privileges. The CVSS score of 5.3 reflects a medium severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or fix details are currently available.

An unauthenticated attacker can extract sensitive information about password-protected vendors or venues via the plugin's REST endpoint. This exposure could lead to privacy violations or aid in further targeted attacks. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the REST endpoint or implementing additional access controls to limit exposure of sensitive information. Monitor vendor communications for updates and apply patches promptly once available.