The vulnerability resides in the Simple Google Calendar Outlook Events Widget WordPress plugin, versions prior to 3.1.0. An attacker can supply an arbitrary URL as the calendar_id parameter. The plugin does not validate this user‑supplied value before issuing a server‑side HTTP request. Consequently, unauthenticated attackers can force the host to fetch internal or external resources, a classic SSRF flaw, and in some cases read the contents of the response. This allows data exfiltration from internal systems or probes of network services that are normally inaccessible from the public internet. The weakness is a server‑side request forgery and can lead directly to information disclosure, with potential cascading effects if internal services are compromised.

Any WordPress site that has the Simple Google Calendar Outlook Events Widget plugin installed and whose version is older than 3.1.0 is affected. Because the plugin is an author‑provided add‑on, the exact publisher name is not publicly disclosed, but the product name is Simple Google Calendar Outlook Events Widget. Site administrators should identify whether the plugin is present and the installed version.

The CVSS score of 5.3 indicates a moderate severity SSRF flaw. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Lack of input validation and the ability to inspect certain internal responses make the vulnerability potentially exploitable by attackers with simple HTTP requests. The likely attack vector is over the public Internet, where an unauthenticated attacker crafts a request to the plugin endpoint with a malicious calendar_id URL, forcing the server to connect to arbitrary destinations.