CVE-2026-16536 is a Server-Side Request Forgery vulnerability in the Simple Google Calendar Outlook Events Widget WordPress plugin. Versions prior to 3.1.0 fail to validate URLs provided by users before performing server-side HTTP requests. This allows unauthenticated attackers to craft requests that the server executes internally, which may lead to unauthorized access to internal resources or data exposure depending on the server's network environment and response handling.

An attacker can leverage this SSRF vulnerability to make the server send arbitrary HTTP requests to internal or external systems. This may allow the attacker to access sensitive internal services or data that are not otherwise exposed externally. The vulnerability does not require authentication, increasing the risk of exploitation. However, no known exploits in the wild have been reported as of the publication date.

No official patch or remediation guidance is currently available. Users should upgrade to version 3.1.0 or later once it is released, as the vulnerability affects versions before 3.1.0. Until a fix is available, consider restricting outbound HTTP requests from the server or applying network-level controls to limit internal resource access. Monitor the vendor advisory for updates on patches or official mitigations.