Calendar Events Widget exposes unauthenticated server-side requests
Simple Google Calendar Outlook Events Widget before 3.1.0 accepts a caller-supplied URL without restricting its destination before the server fetches it. An unauthenticated attacker can make the WordPress host request internal or otherwise protected addresses and, in some configurations, read the internal response. The public advisory does not disclose the endpoint, URL parameter, request function or conditions that make the response visible.
- Component
- Simple Google Calendar Outlook Events Widget
- Plugin slug
simple-google-calendar-outlook-events-widget- Affected
- < 3.1.0
- Safe version
3.1.0- Published
- Aug 04, 2026
This CVE was published Aug 04, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Simple Google Calendar Outlook Events Widget to 3.1.0 or later. Review outbound requests from the WordPress host and rotate internal or cloud credentials if sensitive endpoints may have been reached.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N