# CP Multi View Events Calendar <= 1.4.43 - Missing Authorization to Authenticated (Subscriber+) Calendar Event Modification and Deletion

- **ID:** WPSEC-2026-2155
- **Plugin:** CP Multi View Events Calendar (`cp-multi-view-calendar`), https://wordpress.org/plugins/cp-multi-view-calendar/
- **Affected versions:** all versions before 1.4.44
- **Fixed in:** 1.4.44 (Update to 1.4.44 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cp-multi-view-calendar
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2155/

## Description

The CP Multi View Events Calendar plugin for WordPress is vulnerable to unauthorized modification and loss of data via the 'update', 'remove' and 'adddetails' methods of the event data feed in all versions up to, and including, 1.4.43, due to an insufficient capability check. These methods only checked that the user had the 'read' capability, not that the user was allowed to edit calendar events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, modify and delete arbitrary calendar events.

## References

- https://wpsec.com/vuln/WPSEC-2026-2155/
- https://plugins.svn.wordpress.org/cp-multi-view-calendar/tags/1.4.44/
- https://wordpress.org/plugins/cp-multi-view-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2155/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.