Vulnerability-Lookup

CNVD-2025-19413

Vulnerability from cnvd - Published: 2025-08-25

Title

WordPress插件BizCalendar Web PHP远程文件包含漏洞

Description

WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress插件BizCalendar Web 1.1.0.50及之前版本存在PHP远程文件包含漏洞，该漏洞源于未对本地文件资源的调用做有效过滤，攻击者可利用该漏洞在服务器上包含和执行任意文件。

Severity

高

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://wordpress.org/plugins/bizcalendar-web/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-7650

Impacted products

Name
WordPress BizCalendar Web plugin <=1.1.0.50

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-7650",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650"
    }
  },
  "description": "WordPress\u662f\u4e00\u5957\u4f7f\u7528PHP\u8bed\u8a00\u5f00\u53d1\u7684\u535a\u5ba2\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u652f\u6301\u5728PHP\u548cMySQL\u7684\u670d\u52a1\u5668\u4e0a\u67b6\u8bbe\u4e2a\u4eba\u535a\u5ba2\u7f51\u7ad9\u3002WordPress plugin\u662f\u4e00\u4e2a\u5e94\u7528\u63d2\u4ef6\u3002 \n\nWordPress\u63d2\u4ef6BizCalendar Web 1.1.0.50\u53ca\u4e4b\u524d\u7248\u672c\u5b58\u5728PHP\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5bf9\u672c\u5730\u6587\u4ef6\u8d44\u6e90\u7684\u8c03\u7528\u505a\u6709\u6548\u8fc7\u6ee4\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u670d\u52a1\u5668\u4e0a\u5305\u542b\u548c\u6267\u884c\u4efb\u610f\u6587\u4ef6\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://wordpress.org/plugins/bizcalendar-web/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-19413",
  "openTime": "2025-08-25",
  "products": {
    "product": "WordPress BizCalendar Web plugin \u003c=1.1.0.50"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-7650",
  "serverity": "\u9ad8",
  "submitTime": "2025-08-20",
  "title": "WordPress\u63d2\u4ef6BizCalendar Web PHP\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b\u6f0f\u6d1e"
}

CVE-2025-7650 (GCVE-0-2025-7650)

Vulnerability from cvelistv5 – Published: 2025-08-15 08:25 – Updated: 2025-08-15 16:31

Title

BizCalendar Web <= 1.1.0.50 - Authenticated (Contributor+) Local File Inclusion

Summary

The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.50 via the 'bizcalv' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Assigner

Wordfence

References

URL

Tags

	https://www.wordfence.com/threat-intel/vulnerabil…
	https://wordpress.org/plugins/bizcalendar-web/

Impacted products

	Vendor	Product	Version
	setriosoft	BizCalendar Web	Affected: * , ≤ 1.1.0.50 (semver)

Credits

muhammad yudha

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7650",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-15T16:31:03.173423Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-15T16:31:16.146Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BizCalendar Web",
          "vendor": "setriosoft",
          "versions": [
            {
              "lessThanOrEqual": "1.1.0.50",
              "status": "affected",
              "version": "*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "muhammad yudha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.50 via the \u0027bizcalv\u0027 shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-98",
              "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program (\u0027PHP Remote File Inclusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-15T08:25:37.747Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0640538c-b076-453c-a32e-f33b4e1c77ae?source=cve"
        },
        {
          "url": "https://wordpress.org/plugins/bizcalendar-web/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-08-14T20:14:14.000+00:00",
          "value": "Disclosed"
        }
      ],
      "title": "BizCalendar Web \u003c= 1.1.0.50 - Authenticated (Contributor+) Local File Inclusion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-7650",
    "datePublished": "2025-08-15T08:25:37.747Z",
    "dateReserved": "2025-07-14T17:33:11.276Z",
    "dateUpdated": "2025-08-15T16:31:16.146Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-19413

CVE-2025-7650 (GCVE-0-2025-7650)

Tags

Sightings

Nomenclature