Authorization Bypass in My Calendar Plugin for WordPress

CVE-2026-7525

What is CVE-2026-7525?

The My Calendar – Accessible Event Manager plugin for WordPress contains an authorization bypass vulnerability due to inadequate validation of user permissions. This flaw allows authenticated users with custom-level access or higher to bypass established moderation and approval processes. By directly manipulating the POST request, these users can publish events and alter statuses, such as changing an event to private or cancelling it, even if their role does not permit such actions. While the user interface restricts lower-privilege users to draft submissions, this restriction is only enforced client-side, making it easily circumvented.

References