TI-2026-29085 Aliases CVE-2026-40308 GHSA-2mvx-f5qm-v2ch

My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

HIGH 79CWE-639Published 2026-04-16 · Updated 2026-04-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00932 60th percentileScored 2026-11-07

Fix Fixed my-calendar (joedolson): 3.7.7joedolson/my-calendar (Packagist): 3.7.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
joedolson	my-calendar	before 3.7.7	3.7.7	Patch available	CNA
—	joedolson/my-calendar (Packagist)	before 3.7.7	3.7.7	Patch available	GHSA-2mvx-f5qm-v2ch

my-calendar Vendorjoedolson Affected before 3.7.7 Fixed in 3.7.7 Patch available CNA
joedolson/my-calendar (Packagist) Vendor— Affected before 3.7.7 Fixed in 3.7.7 Patch available GHSA-2mvx-f5qm-v2ch

Remediation

Fix · CNA my-calendar (joedolson) Fixed in 3.7.7
Fix · GHSA-2mvx-f5qm-v2ch joedolson/my-calendar (Packagist) Fixed in 3.7.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-40308
2026-10-03 Alias added: GHSA-2mvx-f5qm-v2ch

References

Other 3

TI-2023-05838 SQL injection in my-calendar CVSS 3.1CRITICAL 9.8
TI-2024-01186 My Calendar < 3.4.24 - Authenticated Stored XSS CVSS 3.1MEDIUM 5.4
TI-2026-75163 Unauthenticated privilege escalation in My Calendar WordPress plugin CVSS 3.1CRITICAL 9.8
TI-2025-03313 My Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
TI-2026-21820 WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
TI-2025-16599 WordPress My Tickets plugin <= 2.0.9 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences