The Pretty Google Calendar WordPress plugin up to version 2.0.0 contains a missing capability check in the pgcal_ajax_handler function, allowing any user to trigger the AJAX endpoint and read the stored Google API key. This provides attackers with a credential that can be used to access the user’s Google Calendar data or impersonate the user in Google services. The weakness is classified as CWE‑862, reflecting an authorization error, and the CVSS score of 5.3 indicates moderate severity.

All installations of the Pretty Google Calendar plugin v2.0.0 or earlier are affected. The plugin is distributed by lbell and is available through the WordPress plugin repository.

The exploit requires no special privileges; any unauthenticated visitor can invoke the vulnerable endpoint, so the attack vector is inferred as public. The low EPSS (<1%) suggests that this vulnerability is not commonly exploited in the wild. It is not listed in CISA’s KEV catalog. Therefore the risk is primarily the exposure of an API key, which can lead to privacy and potentially service disruption if the key is abused. The CVSS score indicates a moderate impact that should be remediated promptly.