CVE-2025-67592
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The My Calendar plugin by Joe Dolson for WordPress up to version 3.6.16 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can exploit this to perform unauthorized actions.
Risk Assessment
The risk involves potential unauthorized access to calendar functions, which could lead to data manipulation or privilege escalation within WordPress.
Recommendation
It is recommended to update the My Calendar plugin to a version newer than 3.6.16 and review access control configurations.
Other vulnerabilities in My Calendar
See all- CVE-2026-40308High
My Calendar (WordPress plugin) versions 3.7.6 and below have a vulnerability in the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users. User-supplied arguments are passed through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite, this enables an unauthenticated attacker to call switch_to_blog() and extract calendar events from any sub-site, including private ones. On Single Site, it causes an uncaught PHP fatal error and crashes the worker thread (DoS).
- CVE-2026-104798Critical
The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.
- CVE-2026-119714Medium
The My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
Original NVD description (English source)
Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS