This vulnerability is a classic Cross‑Site Request Forgery flaw that is present in the Simple calendar for Elementor plugin through version 1.6.4. Because the plugin accepts state‑changing requests without a verification token, an attacker can trick an authenticated user into submitting a request that performs an unintended action on the site. The effect is that the attacker can perform operations that the user is authorized to do, potentially altering calendar entries or other plugin data. The weakness is identified as CWE‑352.

All WordPress sites that have the Michael Simple calendar for Elementor plugin installed with version less than or equal to 1.6.4 are affected. The plugin is available in the WordPress plugin repository.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1 % suggests that active exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. An attacker needs to have the victim authenticated in the site’s administrative or author‑level account, and then coerce the victim to visit a malicious site that contains a crafted request to perform the unwanted action. No additional pre‑conditions such as code execution are required beyond these conditions. Based on the description, the likely attack vector is a malicious webpage that causes the victim’s browser to send a state‑changing request to the vulnerable plugin while the user is authenticated.