Knight Squad Academy
Vulnerability advisory

CVE-2026-1987

Research by Md. Tareq Ahamed Jony February 14, 2026
Overview

Summary

The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the `scheduler_widget_ajax_save_event()` function lacking proper authorization checks and ownership verification when updating events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify any event in the scheduler via the `id` parameter granted they have knowledge of the event ID.

Risk profile

CVSS assessment

5.4 · M E D I U M
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
N E T W O R K
Complexity
L O W
Privileges
L O W
User interaction
N O N E
Scope
U N C H A N G E D
Confidentiality
N O N E
Integrity
L O W
Availability
L O W
Classification

Weaknesses

  • Authorization Bypass Through User-Controlled Key CWE-639
Further reading

References

6 sources
  1. cwe.mitre.org https://cwe.mitre.org/data/definitions/639.html
  2. cwe.mitre.org https://cwe.mitre.org/data/definitions/862.html
  3. owasp.org https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References
  4. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/scheduler-widget/tags/0.1.6/scheduler-widget.php#L158
  5. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/scheduler-widget/trunk/scheduler-widget.php#L158
  6. www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5f370c-743f-41f1-80ab-7f0805cae38c?source=cve