{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24636", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:32:36.811Z", "datePublished": "2026-01-23T14:29:09.318Z", "dateUpdated": "2026-04-28T16:14:50.847Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "sugar-calendar-lite", "product": "Sugar Calendar (Lite)", "vendor": "Syed Balkhi", "versions": [{"changes": [{"at": "3.10.0", "status": "unaffected"}], "lessThanOrEqual": "3.9.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "daroo | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:50.366Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.</p>"}], "value": "Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:50.847Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/sugar-calendar-lite/vulnerability/wordpress-sugar-calendar-lite-plugin-3-10-1-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T15:37:38.203370Z", "id": "CVE-2026-24636", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:44:37.048Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24636", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T15:37:38.203370Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T15:36:13.696Z"}}], "cna": {"title": "WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "daroo | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Syed Balkhi", "product": "Sugar Calendar (Lite)", "versions": [{"status": "affected", "changes": [{"at": "3.10.0", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.9.1"}], "packageName": "sugar-calendar-lite", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:50.366Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/sugar-calendar-lite/vulnerability/wordpress-sugar-calendar-lite-plugin-3-10-1-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:07.160Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24636", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:44:37.048Z", "dateReserved": "2026-01-23T12:32:36.811Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:29:09.318Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar (Lite): from n/a through <= 3.9.1."}, {"lang": "es", "value": "Vulnerabilidad de Autorizaci\u00f3n Faltante en Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite permite Explotar Niveles de Seguridad de Control de Acceso Incorrectamente Configurados. Este problema afecta a Sugar Calendar (Lite): desde n/a hasta &lt;= 3.10.1."}], "id": "CVE-2026-24636", "lastModified": "2026-04-28T15:16:22.030", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-01-23T15:16:23.500", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/sugar-calendar-lite/vulnerability/wordpress-sugar-calendar-lite-plugin-3-10-1-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T07:20:16.669400+00:00", "value": {"mitigation_remediation": ["Upgrade Sugar Calendar (Lite) to the latest version (e.g., 3.10.1) where the access control issue has been fixed.", "If an upgrade is not immediately possible, restrict the plugin functionality to administrators only by editing the CPT/role settings and ensuring that only users with the 'administrator' capability can access the calendar configuration screens.", "Monitor WordPress audit logs for unauthorized attempts to access plugin settings or events and block offending IPs if necessary."], "summary": {"action": "Apply Patch", "impact": "Unauthorized access to plugin functions and data due to broken access control"}, "threat_synthesis": {"affected_systems": "The issue affects the Sugar Calendar (Lite) plugin developed by Syed Balkhi for WordPress installations that are running any release through 3.9.1. The plugin is available as a free or lite version on the WordPress plugin repository. The affected range is noted as n/a through 3.9.1, indicating all versions prior to 3.9.2 are potentially vulnerable.", "description_and_impact": "The vulnerability is an improper access control flaw (CWE\u2011862) that permits users who lack sufficient privileges to access or modify functionality of the Sugar Calendar (Lite) plugin. An attacker could view or alter calendar events, export data, or perform administrative actions without authorization, leading to confidentiality and integrity impact.", "risk_and_exploitability": "The CVSS score of 4.3 indicates moderate severity. Exploit probability according to EPSS is less than 1\u202f%, implying it is unlikely to be widely exploited at present. The vulnerability is not listed in the KEV catalog, and no public exploit is known. Based on the description, it is inferred that an attacker could access or modify calendar events or configuration if they can reach the plugin interface, but the required authentication level is not specified in the CVE data. The potential impact is therefore limited to the data and settings managed by the plugin."}}}}, "created": "2026-01-26T11:52:51.040383+00:00", "updated": "2026-04-16T07:30:28.599692+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}