CVE-2026-22351: WP FullCalendar Auth Bypass Vulnerability

CVE-2026-22351 Overview

CVE-2026-22351 is a Missing Authorization vulnerability affecting the WP FullCalendar WordPress plugin developed by Marcus (aka @msykes). This Broken Access Control vulnerability allows attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized actions within WordPress installations running the vulnerable plugin. The flaw stems from CWE-862 (Missing Authorization), where the plugin fails to properly verify user permissions before executing sensitive operations.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely to bypass access controls, potentially leading to unauthorized data modification and service disruption on affected WordPress sites.

Affected Products

• WP FullCalendar plugin versions up to and including 1.6
• WordPress installations running vulnerable WP FullCalendar versions
• All WP FullCalendar configurations with default or misconfigured access controls

Discovery Timeline

• 2026-02-20 - CVE-2026-22351 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-22351

Vulnerability Analysis

This vulnerability represents a Missing Authorization flaw in the WP FullCalendar WordPress plugin. The core issue is that the plugin does not implement proper authorization checks before allowing certain operations to be performed. In WordPress, plugins should verify user capabilities using functions like current_user_can() before processing sensitive requests.

When authorization checks are missing, any user—including unauthenticated visitors—can potentially invoke functionality that should be restricted to administrators or authenticated users. This can lead to unauthorized modifications to calendar data, settings, or other plugin-managed resources.

The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring any prior authentication or user interaction. While the impact on confidentiality is limited, the vulnerability allows for unauthorized integrity modifications and availability disruptions.

Root Cause

The root cause of CVE-2026-22351 is CWE-862: Missing Authorization. The WP FullCalendar plugin fails to implement proper permission checks on one or more of its endpoints or AJAX handlers. In WordPress plugin development, authorization must be explicitly enforced for all administrative and sensitive operations. The absence of these checks allows attackers to bypass the intended access control model.

This type of vulnerability commonly occurs when developers assume that hiding functionality in the admin interface is sufficient protection, or when AJAX handlers lack proper check_ajax_referer() and capability verification calls.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can craft HTTP requests directly to the vulnerable plugin endpoints to exploit the missing authorization checks.

The exploitation flow typically involves:

1. Identifying the vulnerable AJAX handler or endpoint in the WP FullCalendar plugin
2. Crafting requests that invoke protected functionality without proper authentication
3. Submitting these requests to modify calendar data, settings, or trigger unintended operations

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-22351

Indicators of Compromise

• Unexpected modifications to calendar events or plugin settings without corresponding admin activity logs
• Suspicious HTTP requests to WP FullCalendar AJAX endpoints from unauthenticated sources
• Anomalous patterns in wp-admin/admin-ajax.php access logs with WP FullCalendar action parameters
• Calendar data corruption or unauthorized event entries appearing in the system

Detection Strategies

• Monitor WordPress access logs for requests to admin-ajax.php containing WP FullCalendar action hooks from unauthenticated sessions
• Implement Web Application Firewall (WAF) rules to detect and block suspicious patterns targeting the plugin
• Enable WordPress audit logging to track all calendar-related changes and correlate with authenticated user sessions
• Review server logs for high-frequency requests to plugin endpoints that may indicate exploitation attempts

Monitoring Recommendations

• Configure real-time alerting for unauthorized access attempts to WP FullCalendar endpoints
• Implement SentinelOne Singularity™ Platform to monitor web server processes for anomalous behavior
• Establish baseline metrics for normal plugin usage patterns to identify deviations indicating potential exploitation
• Deploy file integrity monitoring to detect unauthorized changes to plugin files or database entries

How to Mitigate CVE-2026-22351

Immediate Actions Required

• Audit all WordPress installations for the presence of WP FullCalendar plugin version 1.6 or earlier
• Consider temporarily deactivating the plugin until a patched version is available
• Implement WAF rules to restrict access to vulnerable plugin endpoints
• Review calendar data and plugin settings for any unauthorized modifications

Patch Information

At the time of publication, refer to the Patchstack Vulnerability Report for the latest patch information. WordPress administrators should monitor the official WordPress plugin repository for updates to WP FullCalendar that address this vulnerability.

Workarounds

• Restrict access to admin-ajax.php for unauthenticated users if the full calendar functionality is only needed for logged-in users
• Implement server-level access controls using .htaccess or nginx configuration to limit plugin endpoint access
• Use a WordPress security plugin to add capability checks and request validation at the application layer
• Consider using an alternative calendar plugin with proper authorization controls until a fix is released

# Example .htaccess rule to restrict AJAX access (use with caution)
# Add to WordPress root .htaccess to limit admin-ajax.php access
<Files admin-ajax.php>
    <RequireAll>
        Require all granted
        # Add IP restrictions or other access controls as needed
    </RequireAll>
</Files>