Description
The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.53 via the 'bizcalv' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Published: 2025-08-15
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution via LFI on contributor level
Action: Apply patch
AI Analysis

Impact

The BizCalendar Web plugin for WordPress is vulnerable to a local file inclusion flaw triggered through the 'bizcalv' shortcode. Authenticated attackers holding a Contributor role or higher can specify any file path to be included, which allows them to execute PHP code stored on the server. This capability can lead to full code execution, bypass access controls, and theft of sensitive data.

Affected Systems

The vulnerability affects the Setriosoft BizCalendar Web WordPress plugin, all releases version 1.1.0.53 and earlier. Users running any of these versions are susceptible, regardless of the WordPress installation or theme.

Risk and Exploitability

The CVSS base score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The issue is not listed in the CISA KEV catalog. An attacker would need to be authenticated as a Contributor or higher to launch the attack, typically by submitting a request to the bizcalv shortcode and supplying a crafted file path. Once in place, the attacker can execute arbitrary PHP code on the target server.

Generated by OpenCVE AI on April 22, 2026 at 14:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the BizCalendar Web plugin to a version newer than 1.1.0.53 where the LFI issue has been fixed.
  • Restrict the bizcalv shortcode to administrators only or disable it for users with Contributor or lower roles.
  • If an immediate upgrade is not possible, remove the bizcalv shortcode from the site or replace the plugin altogether to prevent the inclusion of arbitrary files.

Generated by OpenCVE AI on April 22, 2026 at 14:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-25005 The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.50 via the 'bizcalv' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
History

Wed, 08 Apr 2026 17:00:00 +0000

Type Values Removed Values Added
Description The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.50 via the 'bizcalv' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.53 via the 'bizcalv' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Title BizCalendar Web <= 1.1.0.50 - Authenticated (Contributor+) Local File Inclusion BizCalendar Web <= 1.1.0.53 - Authenticated (Contributor+) Local File Inclusion
References

Sat, 16 Aug 2025 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 15 Aug 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 15 Aug 2025 08:45:00 +0000

Type Values Removed Values Added
Description The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.0.50 via the 'bizcalv' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Title BizCalendar Web <= 1.1.0.50 - Authenticated (Contributor+) Local File Inclusion
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:33:41.124Z

Reserved: 2025-07-14T17:33:11.276Z

Link: CVE-2025-7650

cve-icon Vulnrichment

Updated: 2025-08-15T16:31:12.418Z

cve-icon NVD

Status : Deferred

Published: 2025-08-15T09:15:29.673

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-7650

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T14:30:18Z

Weaknesses