Medium · 6.3 CVE-2022-29434 EUVD-2022-33772GHSA-384q-gq9c-w4g3

WordPress Spiffy Calendar plugin <= 4.9.0 - Edit/Delete event via IDOR vulnerability

Published May 20, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: Spiffy Plugins Product: Spiffy Calendar

Description

Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events.

Affected products

Vendor	Product	Affected	Fixed
Spiffy Plugins	Spiffy Calendar	<= 4.9.0 – ≤ 4.9.0	—

References

https://wordpress.org/plugins/spiffy-calendar/#developers
https://patchstack.com/database/vulnerability/spiffy-calendar/wordpress-spiffy-calendar-plugin-4-9-0-edit-delete-event-via-idor-vulnerability