Medium severity5.3NVD Advisory· Published Jan 28, 2026· Updated Apr 15, 2026
CVE-2026-1310
CVE-2026-1310
Description
The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6. This is due to missing capability checks on the miga_ajax_editor_cal_delete function that is hooked to the miga_editor_cal_delete AJAX action with both authenticated and unauthenticated access enabled. This makes it possible for unauthenticated attackers to delete arbitrary calendar entries by sending a request with a valid nonce and the calendar entry ID.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=1.6.6
- Range: <=1.6.6
Patches
Vulnerability mechanics
References
4- plugins.trac.wordpress.org/browser/simple-calendar-for-elementor/tags/1.6.6/widget/includes/backend_functions.phpnvd
- plugins.trac.wordpress.org/browser/simple-calendar-for-elementor/trunk/widget/includes/backend_functions.phpnvd
- plugins.trac.wordpress.org/changesetnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/e537c56d-7c5e-4f21-b266-ef3d1a87caf2nvd
News mentions
0No linked articles in our index yet.