Executive brief
The Simple Google Calendar Outlook Events Widget plugin for WordPress contains a server-side request forgery (SSRF) vulnerability that allows attackers to make the web server fetch arbitrary URLs without authentication. An attacker can exploit this to access internal services not directly reachable from the internet, or probe for the existence of internal hosts and services—potentially exposing sensitive data or facilitating further attacks.
Technical details
The plugin fails to validate the user-supplied calendar_id parameter before passing it to a server-side request function, enabling unauthenticated SSRF via the REST API endpoint /wp-json/simple-google-icalendar-widget/v1/content-by-ids. An attacker can craft a request with an arbitrary URL (e.g., http://127.0.0.1:9000/internal.ics) as the calendar_id value, causing the WordPress server to fetch the attacker's target. If the target returns iCalendar-parseable content, the response is reflected back to the attacker; otherwise, the SSRF still occurs (blind) and can be used for internal host/port enumeration. No authentication, cookies, or CSRF tokens are required. The vulnerability was fixed in version 3.1.0.
Affected products
- WP Simple Tech Simple Google Calendar Outlook Events Widget before 3.1.0
Timeline
- 2026-07-25: disclosed
- 2026-07-25: patched: Fixed in version 3.1.0
- 2026-08-04: advisory