Source evidence

3.5.9 is vulnerable to Insecure Direct Object Reference (IDOR

Simple Calendar – Google Calendar Plugin · support · 2026-01-02T04:41:00+00:00

Simple Calendar – Google Calendar Plugin plugin evidence original source source API

neutralsentiment

highseverity

0.62relevance

2replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

7 / 35 rows with source links

20.0% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

28 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

bhautik17 unresolved

Hello Simple Calendar support team, I would like to report a security issue identified in the Simple Calendar plugin (versions <= 3.5.9). Severity: Low (CVSS 5.3) Exploited: No known exploitation at this time Fixed in: No patch available yet Please review and advise on next steps regarding remediation or patch release. Thank You This topic was modified 4 months, 3 weeks ago by bhautik17 . Hi there, Thanks for reaching out to us. About the query here, please reach out to our team here . To protect your website and the security of all our users, we kindly ask that you do not post details regarding security vulnerabilities in the public WordPress support forums. Thank you for your understanding in the meantime. Kind Regards This reply was modified 4 months, 3 weeks ago by john . closed. please communicate non-publicly or reach Plugins team via plugins @ wordpress.org

Commercial Context

Opportunity

booking revenue assurance

Events booking flow assurance for keeping booking availability and appointment flows working

Buyer: service businesses and booking-site builders

Wedge: test events availability, booking notifications, payment handoffs, and calendar sync

Proof Blocked card complete market

Analysis

codex:gpt-5.5

Summary: A user reports an unpatched low-severity IDOR vulnerability and is directed to handle security details privately.

Evidence quote: Fixed in: No patch available yet

Affected feature: IDOR vulnerability

security IDOR vulnerability

Plugin

API

Simple Calendar – Google Calendar Plugin

50.0K active installs · 3.7M downloads · rating 76.0

events google calendar website calendar wp calendar wp calendar widget

Comments

2 shown

john 2026-01-02T08:10:00+00:00

Hi there, Thanks for reaching out to us. About the query here, please reach out to our team here . To protect your website and the security of all our users, we kindly ask that you do not post details regarding security vulnerabilities in the public WordPress support forums. Thank you for your understanding in the meantime. Kind Regards This reply was modified 4 months, 3 weeks ago by john .

Yui 2026-01-02T08:31:00+00:00

closed. please communicate non-publicly or reach Plugins team via plugins @ wordpress.org