CVE-2026-16536: WordPress Calendar Widget SSRF Vulnerability

CVE-2026-16536 Overview

CVE-2026-16536 is a Server-Side Request Forgery (SSRF) vulnerability in the Simple Google Calendar Outlook Events Widget WordPress plugin in versions before 3.1.0. The plugin fails to validate a user-supplied URL before issuing a server-side HTTP request. Unauthenticated attackers can coerce the WordPress server into sending requests to arbitrary destinations, including internal network resources. In some scenarios, the response from the internal request is returned to the attacker, enabling reconnaissance of internal services. The weakness maps to CWE-918.

Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress hosts to probe internal networks and read responses from internal-only services.

Affected Products

Simple Google Calendar Outlook Events Widget WordPress plugin versions prior to 3.1.0
WordPress sites installing the affected plugin in default configuration
Environments where the WordPress host has network access to internal services

Discovery Timeline

2026-08-04 - CVE-2026-16536 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-16536

Vulnerability Analysis

The plugin exposes functionality that accepts a URL parameter and issues an outbound HTTP request from the WordPress server. Because the input is not validated or restricted to an allowlist, an attacker can supply arbitrary URLs, including references to internal hostnames, private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.1), and cloud metadata endpoints such as 169.254.169.254. In some cases the response body is echoed back to the requester, turning a blind SSRF into a read-capable SSRF and expanding the impact to information disclosure of internal services.

Root Cause

The root cause is missing input validation on a user-supplied URL before the server-side fetch is performed. The plugin does not enforce a scheme allowlist, host allowlist, DNS resolution check, or block on private and link-local address ranges. This is a textbook CWE-918: Server-Side Request Forgery pattern.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a URL parameter pointing to an internal resource. The WordPress server performs the request on the attacker's behalf. When the response is returned, the attacker enumerates internal services, retrieves cloud metadata, or accesses admin interfaces bound to localhost. Refer to the WPScan Vulnerability Report for the vulnerable parameter and endpoint details.

No verified public exploit code is available. The vulnerability mechanism is described in prose above rather than with synthetic proof-of-concept code.

Detection Methods for CVE-2026-16536

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal or link-local address ranges shortly after inbound requests to the plugin endpoint
Web access logs showing unauthenticated requests carrying URL parameters that reference 127.0.0.1, 169.254.169.254, or private RFC1918 addresses
Unexpected DNS lookups originating from the PHP worker process for internal hostnames
Spikes in wp_remote_get or curl_exec activity tied to the plugin's request handlers

Detection Strategies

Correlate inbound HTTP requests to the vulnerable plugin path with subsequent outbound connections from the same PHP process
Alert on any egress from web servers to cloud metadata IPs, including 169.254.169.254 and IMDSv2 endpoints
Inspect WordPress access logs for URL-encoded internal targets in query strings and POST bodies
Deploy a web application firewall rule that flags request parameters resolving to private or loopback addresses

Monitoring Recommendations

Forward WordPress web server, PHP-FPM, and egress firewall logs into a centralized data lake for correlation
Baseline normal outbound destinations for each web tier and alert on deviations
Monitor for unauthenticated hits against plugin endpoints combined with anomalous response sizes

How to Mitigate CVE-2026-16536

Immediate Actions Required

Upgrade the Simple Google Calendar Outlook Events Widget plugin to version 3.1.0 or later
If an upgrade cannot be performed immediately, deactivate and remove the plugin
Restrict egress from WordPress hosts to only required external destinations at the network firewall
Block access to cloud instance metadata services from web tiers, or enforce IMDSv2 with hop-limit controls

Patch Information

The vendor addressed the issue in version 3.1.0 of the plugin by validating the user-supplied URL before performing the server-side request. Administrators should apply the update through the WordPress plugin management interface. See the WPScan Vulnerability Report for advisory references.

Workarounds

Apply a web application firewall rule blocking requests where plugin URL parameters reference private, loopback, or link-local IP ranges
Enforce an egress allowlist so the WordPress server can only reach calendar.google.com and outlook.office.com on TCP 443
Run WordPress in a network segment that has no route to internal management interfaces or metadata endpoints
Disable the plugin until the patch is deployed if business impact is acceptable

bash

# Example iptables egress restriction for a WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner www-data -j ACCEPT