Is CVE-2026-1987 actively exploited?

No active exploitation of CVE-2026-1987 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-1987 be exploited remotely?

Yes. CVE-2026-1987 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-1987?

CVE-2026-1987 has a CVSS score of 5.4 (MEDIUM) and an EPSS exploitation probability of 0.05%.

HOME VULNERABILITIESCVE-2026-1987

MEDIUM

CVE-2026-1987

CWE-639Published: February 14, 2026· Updated: Feb 18, 2026

5.4

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:14.6th

Official Description

The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the `scheduler_widget_ajax_save_event()` function lacking proper authorization checks and ownership verification when updating events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify any event in the scheduler via the `id` parameter granted they have knowledge of the event ID.

NVD Source

Technical Analysis

CVE-2026-1987 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.