Missing Authorization in Simple Calendar Plugin for Elementor by WordPress
CVE-2026-1310

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Simple Calendar For Elementor
Vendor
CVE Published:
28 January 2026

What is CVE-2026-1310?

The Simple Calendar for Elementor plugin for WordPress is vulnerable due to inadequate capability checks in the miga_ajax_editor_cal_delete function. This vulnerability allows both authenticated and unauthenticated users to delete calendar entries by crafting a request that contains a valid nonce and the ID of the calendar entry. All versions of the plugin up to and including version 1.6.6 are affected, making it essential for users to update to a patched version to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Simple calendar for Elementor * <= 1.6.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/simple-calenda...
https://plugins.trac.wordpress.org/browser/simple-calenda...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nabil Irawan
JSON
.