The plugin lacks nonce validation on its settings update handler, creating a Cross‑Site Request Forgery flaw (CWE-352). An attacker who can convince a site administrator to click a forged link can trigger an update to the plugin’s Calendly API key, effectively taking control of the API credentials and potentially enabling further data access or impersonation of the account.

The vulnerability affects the WordPress plugin "Upcoming for Calendly" published by justdave, in all releases up to and including version 1.2.4.

The reported CVSS score of 4.3 indicates a low‑to‑moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The weakness is not listed in the CISA KEV catalog. The attack vector is a web application request that requires an ordinary user to be tricked into visiting a crafted link; no authentication is required for the request itself but the action must be performed by an administrator or other user with permission to update plugin settings.