Vulnerabilities / CP Multi View Events Calendar / WPSEC-2026-2155
CP Multi View Events Calendar <= 1.4.43 - Missing Authorization to Authenticated (Subscriber+) Calendar Event Modification and Deletion
Medium 5.4
CWE-862Fixed in 1.4.44
- ID
- WPSEC-2026-2155
- Plugin
- CP Multi View Events Calendar (cp-multi-view-calendar)
- Affected
- all versions before 1.4.44
- Remediation
- Update to 1.4.44 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- CP Multi View Events Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The CP Multi View Events Calendar plugin for WordPress is vulnerable to unauthorized modification and loss of data via the 'update', 'remove' and 'adddetails' methods of the event data feed in all versions up to, and including, 1.4.43, due to an insufficient capability check. These methods only checked that the user had the 'read' capability, not that the user was allowed to edit calendar events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, modify and delete arbitrary calendar events.
References
- https://wpsec.com/vuln/WPSEC-2026-2155/
- https://plugins.svn.wordpress.org/cp-multi-view-calendar/tags/1.4.44/
- https://wordpress.org/plugins/cp-multi-view-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS