Private Google Calendars WordPress Plugin Missing Authorization Vulnerability Allowing Settings Reset

A vulnerability exists in the Private Google Calendars plugin for WordPress, affecting all versions up to and including 20250811. The issue arises from a missing capability check on the 'pgc_remove' action, which allows authenticated attackers with Subscriber-level access and above to unauthorizedly modify data by resetting the plugin's settings.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the plugin's settings by authenticated users with Subscriber-level access or higher.