CVE · Medium
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-24636 | Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform [sugar-calendar-lite] < 3.10.0 | Missing Authorization | Medium 4.3 | < 3.10.0 | 3.10.0 | 2026-01-05 | — |
The Sugar Calendar (Lite) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.9.1. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.
Source: Wordfence
No signup, no credit card — enter your URL and get a security report in seconds.