EUVD-2026-52580
GHSA-ff6j-mvmc-7fp8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-exploitable with no authentication or interaction; read-only SSRF with no integrity or availability impact justifies C:L/I:N/A:N and S:U.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
AnalysisAI
Server-Side Request Forgery in Simple Google Calendar Outlook Events Widget WordPress plugin (all versions before 3.1.0) permits unauthenticated remote attackers to supply arbitrary URLs that the server fetches without validation, potentially exposing responses from internal services. The plugin is confirmed vulnerable by WPScan and a public exploit exists, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation despite the available POC. This vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
The affected component is the Simple Google Calendar Outlook Events Widget WordPress plugin (CPE: cpe:2.3:a:unknown:simple_google_calendar_outlook_events_widget:*), which fetches external calendar data from Google Calendar and Outlook. The root cause is CWE-918 (Server-Side Request Forgery): the plugin passes a user-supplied URL directly to a server-side HTTP client without allowlist validation, scheme filtering, or destination restrictions. This allows the WordPress server to be coerced into issuing requests to arbitrary destinations including RFC-1918 private addresses, loopback interfaces, or cloud instance metadata endpoints such as the AWS IMDSv1 service at 169.254.169.254. The CPE vendor field is listed as 'unknown' in NVD, indicating the vendor identifier has not been fully resolved in the national database.
RemediationAI
Update the Simple Google Calendar Outlook Events Widget plugin to version 3.1.0 or later immediately, as this release introduces URL validation before server-side requests are issued. The patch is confirmed available per the WPScan advisory (https://wpscan.com/vulnerability/effa5549-ecfa-45ba-9044-7345d674c2ca/) and EUVD-2026-52580. If immediate patching is not feasible, deactivating the plugin entirely eliminates the attack surface but also removes all calendar display functionality. As a partial compensating control, configuring the web application firewall to block requests carrying user-controlled URL parameters targeting the plugin's fetch endpoints can reduce exposure; however, without URL validation in the application layer this is bypassable by encoding. For cloud-hosted WordPress instances, enforcing IMDSv2 (requiring a session token) on the underlying instance prevents the highest-impact metadata-exfiltration scenario even if SSRF is triggered.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today