Executive Summary

This vulnerability exists in the Simple calendar for Elementor WordPress plugin up to version 1.6.6. It is caused by missing authorization checks in the function handling the deletion of calendar entries via AJAX. Both authenticated and unauthenticated users can trigger this function, allowing an attacker who can send a request with a valid nonce and calendar entry ID to delete arbitrary calendar entries without proper permission.

Useful 0 Not Useful 0

Impact Analysis

An attacker can delete calendar entries without authorization, potentially disrupting scheduled events or important information displayed on the calendar. This could lead to loss of data integrity and trust in the calendar's accuracy, impacting website functionality and user experience.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Simple calendar for Elementor plugin to a version later than 1.6.6 where the missing authorization checks are fixed. If an update is not available, restrict access to the AJAX action 'miga_editor_cal_delete' to authenticated users with proper capability checks, and monitor for any unauthorized deletion attempts.

Useful 0 Not Useful 0