CVE-2026-40308
HighSummary
My Calendar (WordPress plugin) versions 3.7.6 and below have a vulnerability in the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users. User-supplied arguments are passed through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite, this enables an unauthenticated attacker to call switch_to_blog() and extract calendar events from any sub-site, including private ones. On Single Site, it causes an uncaught PHP fatal error and crashes the worker thread (DoS).
Risk Assessment
The risk includes unauthorized access to calendar events (including private) in Multisite and a DoS attack in Single Site.
Recommendation
Upgrade to version 3.7.7 which contains the fix.
Other vulnerabilities in My Calendar
See all- CVE-2026-104798Critical
The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.
- CVE-2026-119714Medium
The My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.
- CVE-2025-67592Medium
The My Calendar plugin by Joe Dolson for WordPress up to version 3.6.16 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can exploit this to perform unauthorized actions.
Original NVD description (English source)
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS