CVE-2026-16536 is a Server-Side Request Forgery (SSRF) vulnerability in the Simple Google Calendar Outlook Events Widget WordPress plugin versions prior to 3.1.0. The plugin fails to validate user-supplied URLs before performing server-side requests, enabling unauthenticated attackers to induce the server to make arbitrary HTTP requests. This can potentially allow attackers to read responses from internal or protected resources. The vulnerability is identified as CWE-918 and has a CVSS 3.1 base score of 5.3 (medium severity). No official patch or remediation guidance is currently provided in the available data.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests to internal or external systems. This may allow attackers to access internal resources or sensitive information that is not otherwise accessible. The impact is limited to information disclosure as there is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the plugin to prevent exploitation. Monitoring for unusual server requests related to the plugin may help detect exploitation attempts.