Missing Authorization Vulnerability in CalJ Plugin for WordPress

CVE-2026-4117

What is CVE-2026-4117?

The CalJ plugin for WordPress is susceptible to a vulnerability due to absent capability verifications in the CalJSettingsPage class constructor. This oversight allows any authenticated user with Subscriber access or higher to make unauthorized modifications to the plugin's API settings and clear the associated cache. The issue arises as the plugin processes data directly from user POST requests without enforcing proper permissions or nonce validation, potentially enabling attackers to exploit the plugin’s functionality from admin interfaces, thereby affecting its API integrations.

References