The Simple calendar for Elementor plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) identified as CVE-2026-1310. This vulnerability exists in all versions up to and including 1.6.6 due to the absence of proper capability checks on the `miga_ajax_editor_cal_delete` function. This function is hooked to the AJAX action `miga_editor_cal_delete`, which is accessible to both authenticated and unauthenticated users. The vulnerability enables attackers to send crafted AJAX requests containing a valid nonce and a calendar entry ID to delete arbitrary calendar entries without proper authorization. The lack of authorization checks means that the plugin does not verify whether the requester has sufficient permissions to perform deletion operations. While a valid nonce is required, which provides some protection, it can potentially be obtained or bypassed through other vulnerabilities or social engineering. The vulnerability impacts the integrity of calendar data by allowing unauthorized deletion but does not affect confidentiality or availability. No known exploits have been reported in the wild as of the publication date. The CVSS v3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity. The vulnerability is significant for websites relying on the Simple calendar plugin for scheduling or event management, as unauthorized deletion could disrupt operations or communications. The absence of an official patch at the time of reporting necessitates interim mitigations.

For European organizations, the primary impact of CVE-2026-1310 is the potential unauthorized deletion of calendar entries, which compromises data integrity. This can disrupt business operations, event scheduling, and communications that depend on accurate calendar data. While the vulnerability does not expose sensitive information or cause denial of service, the loss or manipulation of calendar data could lead to missed meetings, deadlines, or public events, affecting organizational efficiency and reputation. Organizations in sectors such as education, public administration, event management, and any business relying heavily on WordPress-based websites with the Simple calendar plugin are particularly at risk. The requirement for a valid nonce reduces the likelihood of widespread automated exploitation but does not eliminate targeted attacks or exploitation via chained vulnerabilities. The impact is thus moderate but could be significant in contexts where calendar integrity is critical.

1. Monitor for an official patch from the plugin vendor and apply it promptly once available. 2. Until a patch is released, implement custom authorization checks on the `miga_ajax_editor_cal_delete` AJAX handler to ensure only authorized users can delete calendar entries. This can be done by hooking into WordPress capability checks (e.g., `current_user_can()`) before processing deletion requests. 3. Restrict access to the AJAX action by disabling unauthenticated access or validating user roles explicitly. 4. Harden nonce generation and validation processes to prevent nonce reuse or leakage. 5. Regularly audit WordPress plugins and their permissions to identify and remediate similar authorization issues. 6. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious AJAX requests targeting the vulnerable action. 7. Educate site administrators about the risks of installing plugins without proper security reviews and encourage minimal plugin usage.