CVE-2026-1987 describes an Insecure Direct Object Reference vulnerability in the Scheduler Widget plugin for WordPress (versions up to 0.1.6). The function scheduler_widget_ajax_save_event() fails to perform proper authorization and ownership verification when updating events. Consequently, authenticated users with Subscriber-level privileges or higher can modify any scheduler event by supplying a valid event ID in the id parameter, bypassing intended access controls. This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 5.4, indicating a medium severity level. No known exploits are reported in the wild, and no official patch or remediation is currently documented.

The vulnerability allows authenticated users with low privileges (Subscriber-level or above) to modify scheduler events they do not own, potentially disrupting event integrity and availability. There is no impact on confidentiality. This could lead to unauthorized changes in scheduled events, affecting the reliability of the scheduler functionality within affected WordPress sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, administrators should consider restricting Subscriber-level access or disabling the Scheduler Widget plugin until a fix is available. Monitoring for unusual event modifications by authenticated users may help detect exploitation attempts.