PT-2026-5070 · WordPress · Simple Calendar For Elementor

Nabil Irawan · Published 2026-01-28 · Updated 2026-01-28 · CVE-2026-1310

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple calendar for Elementor plugin for WordPress versions through 1.6.6

Description The Simple calendar for Elementor plugin for WordPress is subject to a missing authorization issue. This is because capability checks are absent in the miga ajax editor cal delete function, which is connected to the miga editor cal delete AJAX action, allowing both authenticated and unauthenticated access. This allows unauthenticated attackers to delete calendar entries by submitting a request containing a valid nonce and the calendar entry ID.

Recommendations Update the Simple calendar for Elementor plugin for WordPress to a version later than 1.6.6.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1310

Affected Products

Simple Calendar For Elementor

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1310 · Security Note
• https://twitter.com/CVEnew/status/2016414564795977949 · Twitter Post
• https://plugins.trac.wordpress.org/browser/simple-calendar-for-elementor/tags/1.6.6/widget/includes/backend_functions.php#L3 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444617%40simple-calendar-for-elementor&new=3444617%40simple-calendar-for-elementor&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/simple-calendar-for-elementor/trunk/widget/includes/backend_functions.php#L3 · Note
• https://t.me/cveNotify/150093 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e537c56d-7c5e-4f21-b266-ef3d1a87caf2?source=cve · Note
• https://t.me/CVEtracker/43113 · Telegram Post