CVE-2026-16536
Received Received - Intake

Server-Side Request Forgery in Simple Google Calendar Outlook Events Widget

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: WPScan

Description
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-24
AI Q&A
2026-08-04
EPSS Evaluated
2026-08-23
NVD
CVE-2026-16536
EUVD
EUVD-2026-52580

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_widget google_calendar_outlook_events_widget to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Simple Google Calendar Outlook Events Widget WordPress plugin before version 3.1.0. It allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) attacks by supplying a malicious URL. The plugin does not validate the URL before making an internal server request, which could allow attackers to read responses from internal systems.

Detection Guidance

This vulnerability can be detected by checking if the Simple Google Calendar Outlook Events Widget WordPress plugin is outdated. Run commands like 'wp plugin list' in WordPress or check the plugin version via the WordPress admin panel. Look for version 3.1.0 or earlier.

Impact Analysis

If you use this WordPress plugin before version 3.1.0, attackers could exploit this to trick your server into making unauthorized requests to internal or external systems. This could lead to data leaks, unauthorized access to sensitive information, or further attacks on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using this plugin risk non-compliance due to potential data breaches or unauthorized data access.

Mitigation Strategies

Immediately update the Simple Google Calendar Outlook Events Widget plugin to version 3.1.0 or later. If updating is not possible, consider disabling or removing the plugin until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16536. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart