The Simple calendar for Elementor plugin for WordPress contains a missing authorization check on the miga_ajax_editor_cal_delete function, which is hooked to the miga_editor_cal_delete AJAX action and exposed to both authenticated and unauthenticated requests. An attacker can send a request that includes a valid nonce and a specific calendar entry ID to the AJAX handler, causing that entry to be deleted. Since the action bypasses all capability checks, unauthenticated users are able to remove arbitrary entries, leading to unintended loss of content and potential disruption of calendar functionality for site users. This flaw is identified as CWE-862, "Missing Authorization".

WordPress sites that have installed the migaweb Simple calendar for Elementor plugin, versions 1.6.6 and earlier. The vulnerability is present in any deployment of these plugin versions because the insecure AJAX action is registered unconditionally.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of real‑world exploitation at present. The likely attack vector is a web‑based AJAX request that includes a valid nonce; the requirement for a nonce may constrain immediate exploitation but does not eliminate the risk if an attacker can acquire or guess a nonce from the site context. Overall, the threat is moderate but the current probability of exploitation is low.