This vulnerability in the Simple calendar for Elementor plugin (versions <= 1.6.4) allows an attacker to perform Cross-Site Request Forgery (CSRF) attacks. CSRF vulnerabilities enable attackers to induce authenticated users to submit unwanted requests to the application, potentially leading to unauthorized actions. The CVSS vector indicates the attack can be performed remotely over the network without privileges but requires user interaction. The impact is limited to integrity loss without confidentiality or availability impact.

The vulnerability could allow an attacker to cause an authenticated user to perform unintended actions on the affected plugin, potentially altering data or settings. There is no impact on confidentiality or availability reported. The medium CVSS score reflects the limited scope and requirement for user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying request origins or disabling the plugin if not essential. Monitor vendor channels for updates and apply patches promptly once released.