WordPress security changelog
MEDIUM CVE-2026-16536 Received

Calendar Events Widget exposes unauthenticated server-side requests

Simple Google Calendar Outlook Events Widget before 3.1.0 accepts a caller-supplied URL without restricting its destination before the server fetches it. An unauthenticated attacker can make the WordPress host request internal or otherwise protected addresses and, in some configurations, read the internal response. The public advisory does not disclose the endpoint, URL parameter, request function or conditions that make the response visible.

CVE / CNA score 5.3 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
Simple Google Calendar Outlook Events Widget
Plugin slug
simple-google-calendar-outlook-events-widget
Affected
< 3.1.0
Safe version
3.1.0
Published
Aug 04, 2026
Weakness
CWE-918 — Server-Side Request Forgery (SSRF)

This CVE was published Aug 04, 2026 and is one of 1 known issue for this plugin.

Update, patch or deactivate.

Update Simple Google Calendar Outlook Events Widget to 3.1.0 or later. Review outbound requests from the WordPress host and rotate internal or cloud credentials if sensitive endpoints may have been reached.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Technical description

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary and upstream sources