PT-2026-34285 · WordPress · Calj

Nabil Irawan · Published 2026-04-22 · Updated 2026-05-01 · CVE-2026-4117

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CalJ versions prior to 1.6

Description The CalJ plugin for WordPress contains a missing authorization flaw. The CalJSettingsPage class constructor processes the 'save-obtained-key' operation from POST data without verifying if the user possesses the manage options capability and without performing nonce verification. Because the calj.php bootstrap file instantiates CalJSettingsPage for any authenticated user accessing wp-admin URLs, such as 'admin-ajax.php', users with Subscriber-level access or higher can modify the API key setting and clear the Shabbat cache, allowing them to control the API integration.

Recommendations Update to a version later than 1.5.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4117

Affected Products

Calj

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-4117 · Security Note
• https://reddit.com/r/StopBadBots/comments/1t0qbbs/critical_alert_20_unpatched_wordpress · Reddit Post
• https://twitter.com/VulmonFeeds/status/2046945628412883441 · Twitter Post
• https://plugins.trac.wordpress.org/browser/calj/trunk/CalJSettingsPage.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/calj/tags/1.5/CalJSettingsPage.php#L30 · Note
• https://plugins.trac.wordpress.org/browser/calj/trunk/CalJSettingsPage.php#L30 · Note
• https://twitter.com/CVEnew/status/2047428111902650689 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d1c7df8e-2f82-4474-88ef-8c8ddaeb4656?source=cve · Note
• https://plugins.trac.wordpress.org/browser/calj/tags/1.5/calj.php#L17 · Note
• https://plugins.trac.wordpress.org/browser/calj/trunk/calj.php#L17 · Note
• https://plugins.trac.wordpress.org/browser/calj/tags/1.5/CalJSettingsPage.php#L25 · Note