CVE-2025-14160: XSRF in Upcoming for Calendly WordPress Plugin

The primary impact of this XSRF vulnerability lies in the ability of an attacker to modify the Upcoming for Calendly plugin's Calendly API key. Successful exploitation allows an attacker to impersonate the legitimate Calendly integration, potentially scheduling unauthorized events, accessing sensitive user data associated with those events, and disrupting the scheduling process. This could lead to denial of service or even data breaches if the Calendly integration handles sensitive information. The attack requires tricking a site administrator into clicking a malicious link, highlighting the importance of user awareness and security best practices.

1. Reserved2025-12-05
2. Published2025-12-12
3. Modified2026-04-08
4. EPSS updated2026-03-23

The recommended mitigation is to immediately upgrade the Upcoming for Calendly plugin to version 1.2.5 or later, which addresses the missing nonce validation. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing strict input validation on the Calendly API key settings page to prevent malicious input. Additionally, enforce strong password policies and implement multi-factor authentication for all WordPress administrator accounts to reduce the risk of account compromise and subsequent exploitation. After upgrading, confirm the fix by attempting to update the Calendly API key via a crafted request and verifying that the action is rejected.

Active installs

100

Plugin rating