GCVE - cpe:2.3:a:morelmathieuj:scheduler

Approved changes feed: RSS · Atom

cpe:2.3:a:morelmathieuj:scheduler_widget:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Morelmathieuj (`9e7e6ff6-1f94-5a6b-aee0-02671ecef2e9`)
Product	Scheduler Widget (`d7643236-1aef-562d-8988-e0876fc4b37c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-1987`	vulnerable	2026-06-08 07:49:09.958703	Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification MEDIUM (5.4) The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the `scheduler_widget_ajax_save_event()` function lacking proper authorization checks and ownership verification when updating events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify any event in the scheduler via the `id` parameter granted they have knowledge of the event ID. Published: 2026-02-14T06:42:37.284Z Updated: 2026-04-08T17:34:57.193Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/fd5f370c-743f-41f1-80ab-7f0805cae38c?source=cve https://plugins.trac.wordpress.org/browser/scheduler-widget/trunk/scheduler-widget.php#L158 https://plugins.trac.wordpress.org/browser/scheduler-widget/tags/0.1.6/scheduler-widget.php#L158 https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References https://cwe.mitre.org/data/definitions/639.html	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.