Privilege Escalation Vulnerability in My Calendar Plugin for WordPress
CVE-2026-104798

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
My Calendar – Accessible Event Manager
Vendor
CVE Published:
16 October 2026

What is CVE-2026-104798?

The My Calendar plugin for WordPress contains a vulnerability that allows unauthenticated attackers to exploit the unsanitized mcs GET parameter, enabling the injection of a malicious shortcode. This vulnerability ultimately leads to unauthorized execution of arbitrary PHP functions, including the ability to alter user credentials, thereby granting attackers complete administrative access to the WordPress site's admin panel. The exploit is easily accessible via the publicly exposed /my-calendar/ page, which is available by default upon installation. This poses a significant risk to WordPress users who have not updated to patched versions.

Affected Version(s)

My Calendar – Accessible Event Manager 0 <= 3.4.24

My Calendar – Accessible Event Manager 3.5 <= 3.5.21

My Calendar – Accessible Event Manager 3.6 <= 3.6.17

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/my-calendar/ta...
https://plugins.trac.wordpress.org/browser/my-calendar/ta...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

daroo
.