CVE-2026-1310 describes a missing authorization vulnerability (CWE-862) in the Simple calendar for Elementor plugin for WordPress. The vulnerability arises from the lack of capability checks in the `miga_ajax_editor_cal_delete` function, which is hooked to the `miga_editor_cal_delete` AJAX action. Both authenticated and unauthenticated users can access this action, and if an attacker provides a valid nonce and calendar entry ID, they can delete calendar entries without proper authorization. This affects all versions up to and including 1.6.6.

An attacker without authentication privileges can delete arbitrary calendar entries if they can supply a valid nonce. This results in integrity loss of calendar data but does not impact confidentiality or availability directly. There is no indication of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided at this time. Until a fix is available, administrators should monitor for updates from the vendor and consider restricting access to AJAX actions or implementing additional authorization checks as a temporary measure.