Simple calendar for Elementor, CVE-2026-1310

CVE, Research URL: CVE-2026-1310
Home page URL: Security reports for Simple calendar for Elementor
Application: Simple calendar for Elementor
Published on: Jan 28, 2026
Research Description: The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the `miga_ajax_editor_cal_delete` function that is hooked to the `miga_editor_cal_delete` AJAX action with both authenticated and unauthenticated access enabled. This makes it possible for unauthenticated attackers to delete arbitrary calendar entries by sending a request with a valid nonce and the calendar entry ID.
Affected versions: max 1.6.7.
Status: vulnerable