Insecure Direct Object Reference in My Calendar Plugin by WordPress

CVE-2026-11896

What is CVE-2026-11896?

The My Calendar – Accessible Event Manager plugin for WordPress contains a vulnerability that allows unauthenticated users to exploit an insecure direct object reference through the 'vcal' parameter. This lack of user input validation enables attackers to enumerate occurrence IDs and gain unauthorized access to sensitive calendar information. These exploits potentially expose non-public, draft, trashed, and personal calendar events, revealing critical event details such as titles, descriptions, dates, and organizer information, which could compromise user privacy and security.

References