{
 "id": "WPSEC-2026-2155",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2155/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2155/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2155/index.md",
 "title": "CP Multi View Events Calendar <= 1.4.43 - Missing Authorization to Authenticated (Subscriber+) Calendar Event Modification and Deletion",
 "description": "The CP Multi View Events Calendar plugin for WordPress is vulnerable to unauthorized modification and loss of data via the 'update', 'remove' and 'adddetails' methods of the event data feed in all versions up to, and including, 1.4.43, due to an insufficient capability check. These methods only checked that the user had the 'read' capability, not that the user was allowed to edit calendar events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, modify and delete arbitrary calendar events.",
 "plugin": {
  "slug": "cp-multi-view-calendar",
  "name": "CP Multi View Events Calendar",
  "full_name": "CP Multi View Events Calendar",
  "wordpress_org": "https://wordpress.org/plugins/cp-multi-view-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cp-multi-view-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cp-multi-view-calendar"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.4.44",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.4.44"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.4.44",
 "remediation": "Update to 1.4.44 or later.",
 "fix_released": "2026-10-29T21:29:24+00:00",
 "published": "2026-10-30T21:40:51+00:00",
 "updated": "2026-10-30T09:30:28.795659+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2155/",
  "https://plugins.svn.wordpress.org/cp-multi-view-calendar/tags/1.4.44/",
  "https://wordpress.org/plugins/cp-multi-view-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cp-multi-view-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-30"
 }
}