The Scheduler Widget plugin for WordPress is vulnerable to an insecure direct object reference in the scheduler_widget_ajax_save_event() handler. The function accepts an event id parameter but does not perform authorization checks or ownership verification, allowing any authenticated user who has Subscriber-level access or higher to modify the data of any event. This flaw can enable a user to change event schedules or details, potentially disrupting scheduled events or exposing sensitive information. The flaw is classified as CWE-639.

All installations of the Scheduler Widget plugin for WordPress, from vendor morelmathieuj, with version 0.1.6 or earlier are affected. Any WordPress site that has installed this plugin and has users with Subscriber role or higher is potentially impacted.

The CVSS base score is 5.4, indicating moderate severity, and the EPSS score is less than 1%, implying a very low exploitation probability. The vulnerability is not currently listed in CISA's KEV catalog, suggesting it has not been widely exploited. An attacker would need to be authenticated on the site with a Subscriber role or higher and possess knowledge of the numeric event ID. Once authenticated, the attacker can send an AJAX request to the plugin’s save endpoint with the target event ID to create or alter any event. No additional conditions are specified, so the attack is relatively straightforward for an insider or compromised account.