Read the docs
TI-2026-75163 Aliases CVE-2026-104798GHSA-jcj4-jrhq-cjvh

Unauthenticated privilege escalation in My Calendar WordPress plugin

Priority MEDIUM 49CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

The My Calendar plugin (Accessible Event Manager) for WordPress is affected in all versions up to and including 3.8.7. Unsanitized input in the mcs parameter is reflected into post content, and the plugin then passes attacker-controlled values to call_user_func() without any authentication or authorization check (CWE-269). An unauthenticated remote attacker can use this to overwrite the credentials of the initial Administrator account (user ID 1) and gain full wp-admin access.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00471 40th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
joedolsonMy Calendar – Accessible Event Managerup to 3.4.24; 3.5 – 3.5.21; 3.6 – 3.6.17; 3.7 – 3.7.17; 3.8 – 3.8.7—No fix listedCNA
  • My Calendar – Accessible Event Manager Vendorjoedolson Affected up to 3.4.24; 3.5 – 3.5.21; 3.6 – 3.6.17; 3.7 – 3.7.17; 3.8 – 3.8.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for My Calendar (Accessible Event Manager).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-104798
  2. 2026-10-16 Alias added: GHSA-jcj4-jrhq-cjvh
  3. 2026-10-16 CISA SSVC decision points changed
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 8

  • TI-2023-05838 SQL injection in my-calendar CVSS 3.1CRITICAL 9.8
  • TI-2026-29085 My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog CVSS 4.0HIGH 8.8
  • TI-2024-01186 My Calendar < 3.4.24 - Authenticated Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2025-03313 My Tickets – Accessible Event Ticketing <= 2.0.16 - Authenticated (Subscriber+) Privilege Escalation CVSS 3.1HIGH 8.8
  • TI-2026-21820 WordPress My Tickets plugin <= 2.1.0 - Sensitive Data Exposure vulnerability CVSS 3.1HIGH 7.5
  • TI-2025-16599 WordPress My Tickets plugin <= 2.0.9 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences