CVE-2025-68979: 
WordPress vulnerability analysis and mitigation

CVE-2025-68979 is an Insecure Direct Object Reference (IDOR) / Authorization Bypass Through User-Controlled Key vulnerability in the SimpleCalendar Google Calendar Events WordPress plugin. It affects all versions through 3.5.9 and was discovered by researcher Doan Dinh Van, reported on November 18, 2025, and published on December 18–30, 2025. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), with no authentication required for exploitation (Patchstack).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a form of IDOR where the plugin fails to properly validate whether a requesting user is authorized to access a specific calendar resource identified by a user-supplied key or identifier. An unauthenticated remote attacker can manipulate object references in network requests to access calendar data they should not be permitted to view, requiring no user interaction and no special privileges. The vulnerability is categorized under OWASP Top 10 A1: Broken Access Control (Patchstack).

Successful exploitation results in unauthorized read access to calendar event data, impacting confidentiality with low severity (no integrity or availability impact per the CVSS score). An unauthenticated attacker could enumerate and access calendar entries that may contain sensitive scheduling information, meeting details, or organizational data. While the direct impact is limited to information disclosure, such data could facilitate social engineering or targeted attacks against an organization (Patchstack).

There is no public proof-of-concept exploit code available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vulnerability is patched in Google Calendar Events plugin version 3.6.0. Site administrators should update the plugin immediately to version 3.6.0 or later via the WordPress admin dashboard. Patchstack users can enable auto-update for vulnerable plugins to automate remediation. As an interim measure, review and audit access control configurations for the plugin and consider restricting access to calendar endpoints at the web server or WAF level (Patchstack).

The vulnerability received brief coverage on security-focused social media accounts including TheHackerWire on Mastodon and Infosec.exchange, as well as listing on threat intelligence aggregators such as VulDB and radar.offseq.com. No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.