Authorization Bypass Vulnerability in SimpleCalendar Google Calendar Events Plugin
CVE-2025-68979

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Google Calendar Events
Vendor
CVE Published:
30 December 2025

What is CVE-2025-68979?

A vulnerability exists in the SimpleCalendar Google Calendar Events plugin due to improperly configured access controls, allowing unauthorized users to bypass authentication measures. This issue particularly impacts versions of the plugin up to 3.5.9, enabling potential exploitation by malicious actors who can leverage user-controlled keys to gain unauthorized access to restricted features or data.

Affected Version(s)

Google Calendar Events 0 <= 3.5.9

References

https://patchstack.com/database/Wordpress/Plugin/google-c...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Doan Dinh Van | Patchstack Bug Bounty Program
.