CVE-2026-1310

CVE-2026-1310 affects the Simple calendar for Elementor plugin for WordPress, specifically versions up to and including 1.6.6. It is a Missing Authorization vulnerability where the miga_ajax_editor_cal_delete function lacks proper capability checks. This allows unauthenticated attackers to delete arbitrary calendar entries by sending a crafted request with a valid nonce and the entry ID. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with low complexity and no user interaction required, leading to a low impact on integrity (deletion of data). While the FAUCET Risk Score is 82/100, suggesting a higher potential risk, the EPSS score is very low, implying a low probability of exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting a lack of widespread attention or exploitation.