Insecure Direct Object Reference Vulnerability in Scheduler Widget for WordPress

CVE-2026-1987

What is CVE-2026-1987?

The Scheduler Widget plugin for WordPress contains a vulnerability that allows authenticated users with Subscriber-level permissions and above to exploit an Insecure Direct Object Reference. This flaw arises from inadequate authorization checks in the scheduler_widget_ajax_save_event() function, enabling attackers to modify any scheduler event by manipulating the id parameter, provided they know the corresponding event ID. This oversight presents a significant security risk as it can lead to unauthorized changes to event details.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References