Description
WordPress Plugin WP FullCalendar is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently get the content of arbitrary posts, including draft/private as well as password-protected ones. WordPress Plugin WP FullCalendar version 1.4.1 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 1.5 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:5A69965D-D243-4D51-B7A4-D6F4B199ABF1
https://plugins.svn.wordpress.org/wp-fullcalendar/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Visual Link Preview Security Bypass (2.2.2)
WordPress Plugin WP Sitemap Page Cross-Site Scripting (1.6.6)
Internet Information Services Unchecked Return Value Vulnerability (CVE-2005-4360)
b2evolution Credentials Management Errors Vulnerability (CVE-2016-9479)
WordPress Plugin Fusion:Extension-Menu Multiple Unspecified Vulnerabilities (1.0.2)