Missing Authorization vulnerability in Marcus' WP FullCalendar plugin allows exploitation of incorrectly configured access control. The plugin does not enforce proper authorization for certain operations, enabling an attacker to perform privileged actions such as creating, modifying, or deleting calendar events, or viewing sensitive event data. This flaw is classified as CWE-862 and can compromise the confidentiality, integrity, and availability of the site's scheduling information.

Version 1.6 and earlier of Marcus' WP FullCalendar WordPress plugin are affected. The vulnerability applies to all WordPress sites that have this plugin installed and activated, regardless of the website's configuration or host.

The CVSS score is 7.5, indicating a high severity vulnerability. The EPSS score is less than 1%, suggesting a low probability of real-world exploitation at this time, and the flaw is not listed in the CISA KEV catalog. Based on the plugin's nature as a WordPress extension, the likely attack vector is remote HTTP requests to the plugin's endpoints. An attacker with any user access to the site, or who can send crafted requests, could exploit this weakness without needing additional privileges, making it a significant risk in environments lacking stricter access controls.