CVE-2026-1310
|
| |
|
|
Software afectado |
WORDPRESS |
|
|
|
The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the `miga_ajax_editor_cal_delete` function that is hooked to the `miga_editor_cal_delete` AJAX action with both authenticated and unauthenticated access enabled. This makes it possible for unauthenticated attackers to delete arbitrary calendar entries by sending a request with a valid nonce and the calendar entry ID. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-1310 |
