WordPress Plugin Vulnerabilities

CP Multi View Event Calendar < 1.4.37 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with editor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
cp-multi-view-calendar
Fixed in 1.4.37

References

CVE
CVE-2025-58009
URL
https://patchstack.com/database/wordpress/plugin/cp-multi-view-calendar/vulnerability/wordpress-cp-multi-view-event-calendar-plugin-1-4-32-broken-access-control-vulnerability

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
3.8 (low)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
b0a7daec-6289-4833-80e6-e5d8a63589d4

Timeline

Publicly Published
2025-09-22 (about 11 months ago)
Added
2025-09-26 (about 11 months ago)
Last Updated
2026-08-28 (about 23 days ago)

Other

Published
Title
Published
2023-09-04
Title
Bulk NoIndex & NoFollow Toolkit < 1.51 - Missing Authorization
Published
2025-04-15
Title
JetBlog < 2.4.3.1 - Missing Authorization
Published
2026-01-28
Title
JAMstack Deployments <= 1.1.1 - Missing Authorization
Published
2025-11-17
Title
Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification
Published
2024-11-12
Title
Kognetiks Chatbot for WordPress < 2.1.8 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion