The vulnerability resides in the Simple Google Calendar Outlook Events Widget WordPress plugin, versions prior to 3.1.0. An attacker can supply an arbitrary URL as the calendar_id parameter. The plugin does not validate this user–supplied value before issuing a server‑side HTTP request. Consequently, unauthenticated attackers can force the host to fetch internal or external resources, a classic SSRF flaw, and in some cases read the contents of the response. This allows data exfiltration from internal systems or probes of network services that are normally inaccessible from the public internet. The weakness is a server‑side request forgery and can lead directly to information disclosure, with potential cascading effects if internal services are compromised.

Any WordPress site that has the Simple Google Calendar Outlook Events Widget plugin installed and whose version is older than 3.1.0 is affected. Because the plugin is an author‑provided add‑on, the exact publisher name is not publicly disclosed, but the product name is Simple Google Calendar Outlook Events Widget. Site administrators should identify whether the plugin is present and the installed version.

The CVSS score is not provided, but SSRF vulnerabilities are commonly high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting no publicly documented exploit at present. However, the lack of input validation and the ability to read response data makes this flaw potentially exploitable by attackers with simple HTTP requests. The likely attack vector is over the public Internet, whereby an unauthenticated adversary crafts a request to the affected plugin endpoint with a malicious calendar_id URL, forcing the server to connect to arbitrary destinations.