CVE-2026-1310

Name of the Vulnerable Software and Affected Versions Simple calendar for Elementor plugin for WordPress versions through 1.6.6

Description The Simple calendar for Elementor plugin for WordPress is subject to a missing authorization issue. This is because capability checks are absent in the miga ajax editor cal delete function, which is connected to the miga editor cal delete AJAX action, allowing both authenticated and unauthenticated access. This allows unauthenticated attackers to delete calendar entries by submitting a request containing a valid nonce and the calendar entry ID.

Recommendations Update the Simple calendar for Elementor plugin for WordPress to a version later than 1.6.6.