CVE-2026-11896
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile — higher than 23% of all known CVEs
Summary
The My Calendar – Accessible Event Manager plugin for WordPress up to version 3.7.14 inclusive contains an Insecure Direct Object Reference (IDOR) vulnerability via the 'vcal' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events.
Risk Assessment
The organization is at risk of exposing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata, potentially leading to privacy breaches and information leakage.
Recommendation
Immediately update the My Calendar – Accessible Event Manager plugin to the latest available version that fixes this vulnerability. Until the update is applied, restrict access to the 'vcal' parameter using a Web Application Firewall (WAF) or server rules.
Original NVD description (English source)
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.