The vulnerability is an Insecure Direct Object Reference that allows an attacker to bypass authorization controls by manipulating a user‑controlled key, enabling access to calendar events belonging to other users. This flaw results in unauthorized disclosure of calendar information and can compromise data confidentiality and integrity. The weakness is identified as CWE‑639 and can be triggered by a user who can execute plugin functions, potentially exposing sensitive scheduling data.

Affected is the WordPress Google Calendar Events plugin developed by SimpleCalendar, versions from the earliest available release through version 3.5.9. Administrators should review any installations of this plugin on WordPress sites, as they may be vulnerable.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the IDOR by interacting with the plugin’s user‑controlled keys typically through the web interface, requiring an authenticated session or a valid user role. The requirement of such prerequisites reduces exploit probability but still poses a meaningful risk for sites with broad admin permissions.