Authorization Bypass Vulnerability in SimpleCalendar Google Calendar Events Plugin
CVE-2025-68979

8.1HIGH

Key Information:

Vendor

WordPress
Status
Google Calendar Events
Vendor
CVE Published:
30 December 2025

What is CVE-2025-68979?

A vulnerability exists in the SimpleCalendar Google Calendar Events plugin due to improperly configured access controls, allowing unauthorized users to bypass authentication measures. This issue particularly impacts versions of the plugin up to 3.5.9, enabling potential exploitation by malicious actors who can leverage user-controlled keys to gain unauthorized access to restricted features or data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Google Calendar Events <= n/a

References

https://patchstack.com/database/Wordpress/Plugin/google-c...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Doan Dinh Van | Patchstack Bug Bounty Program
JSON
.