CVE-2026-1310
Missing Authorization in Simple Calendar Plugin Allows Entry Deletion
Publication date: 2026-01-28
Last updated on: 2026-01-28
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpdevart | simple_calendar_for_elementor | to 1.6.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Simple calendar for Elementor WordPress plugin up to version 1.6.6. It is caused by missing authorization checks in the function handling the deletion of calendar entries via AJAX. Both authenticated and unauthenticated users can trigger this function, allowing an attacker who can send a request with a valid nonce and calendar entry ID to delete arbitrary calendar entries without proper permission.
How can this vulnerability impact me? :
An attacker can delete calendar entries without authorization, potentially disrupting scheduled events or important information displayed on the calendar. This could lead to loss of data integrity and trust in the calendar's accuracy, impacting website functionality and user experience.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Simple calendar for Elementor plugin to a version later than 1.6.6 where the missing authorization checks are fixed. If an update is not available, restrict access to the AJAX action 'miga_editor_cal_delete' to authenticated users with proper capability checks, and monitor for any unauthorized deletion attempts.