PT-2026-34285 · Calj · Calj Shabbat Times

Nabil Irawan · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-4117

NVD

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5. This is due to a missing capability check in the CalJSettingsPage class constructor, which processes the 'save-obtained-key' operation directly from POST data without verifying that the requesting user has the 'manage options' capability, and without any nonce verification. The plugin bootstrap file (calj.php) instantiates CalJSettingsPage whenever is admin() returns true, which is the case for any authenticated user making requests to wp-admin URLs (including admin-ajax.php). This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API key setting and clear the Shabbat cache, effectively taking control of the plugin's API integration.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4117

Affected Products

Calj Shabbat Times

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-4117 · Security Note
• https://plugins.trac.wordpress.org/browser/calj/tags/1.5/calj.php#L17 · Note
• https://plugins.trac.wordpress.org/browser/calj/trunk/calj.php#L17 · Note
• https://plugins.trac.wordpress.org/browser/calj/tags/1.5/CalJSettingsPage.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/calj/trunk/CalJSettingsPage.php#L30 · Note
• https://plugins.trac.wordpress.org/browser/calj/tags/1.5/CalJSettingsPage.php#L30 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d1c7df8e-2f82-4474-88ef-8c8ddaeb4656?source=cve · Note
• https://plugins.trac.wordpress.org/browser/calj/trunk/CalJSettingsPage.php#L25 · Note