CVE-2025-7650 in BizCalendar Web Plugin
Summary
by MITRE • 08/15/2025
The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.50 via the 'bizcalv' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2025
The vulnerability identified as CVE-2025-7650 affects the BizCalendar Web plugin for WordPress, presenting a critical local file inclusion flaw that impacts all versions up to and including 1.1.0.50. This security weakness manifests through the 'bizcalv' shortcode implementation, creating a pathway for authenticated attackers who possess Contributor-level privileges or higher to execute arbitrary file inclusion attacks against affected systems. The vulnerability represents a significant risk to WordPress installations as it allows for remote code execution through the manipulation of file inclusion parameters within the plugin's shortcode functionality.
The technical exploitation of this vulnerability occurs through the improper handling of user-supplied input within the bizcalv shortcode parameter. When an authenticated user with Contributor privileges or higher submits a request containing malicious file paths through the shortcode, the plugin fails to properly validate or sanitize the input before processing file inclusion operations. This lack of input validation creates an environment where attackers can specify arbitrary file paths that the plugin then attempts to include and execute, effectively bypassing normal file access controls and allowing for arbitrary code execution within the context of the web server.
The operational impact of this vulnerability extends beyond simple code execution capabilities, as it provides attackers with the means to bypass access controls that should normally protect sensitive system resources. An attacker with Contributor-level access can leverage this vulnerability to read sensitive files from the server, potentially including configuration files, database credentials, or other confidential information stored within the WordPress installation. Additionally, the ability to execute arbitrary PHP code through uploaded files that can be included via the shortcode creates opportunities for persistent backdoor installation, data exfiltration, or further compromise of the affected system.
The vulnerability aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks. This classification indicates that the root cause stems from inadequate input validation and sanitization of file path parameters within the plugin's shortcode implementation. Furthermore, the attack vector demonstrates characteristics consistent with ATT&CK technique T1505.003, which involves the use of web shells or command execution through web applications, as the vulnerability enables remote code execution through legitimate plugin functionality.
Mitigation strategies for this vulnerability should begin with immediate plugin updates to versions that address the local file inclusion flaw, as developers have likely released patches or newer versions that properly validate and sanitize input parameters. Administrators should also implement additional security measures including restricting Contributor-level user permissions to minimize potential attack surface, monitoring for unusual file inclusion patterns in server logs, and implementing proper file upload validation to prevent malicious files from being stored on the server. Network-based intrusion detection systems should be configured to monitor for suspicious shortcode parameter usage that may indicate exploitation attempts. Additionally, organizations should conduct comprehensive security assessments of their WordPress installations to identify any other potentially vulnerable plugins or themes that may present similar local file inclusion risks, ensuring that all components maintain proper input validation and sanitization practices to prevent similar vulnerabilities from being exploited in the future.