Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.
Published: 2026-10-16
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation to Administrator
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a privilege escalation flaw caused by unsanitized reflection of the public GET parameter 'mcs' into post content. An attacker may inject a nested [my_calendar above=...] shortcode; the shortcode attribute 'above' is split on commas and each element is dispatched via call_user_func() without any authentication or allowlist. This allows an unauthenticated attacker to execute arbitrary PHP functions. By passing the shortcode $params array to edit_user(), PHP coerces the $user_id to integer 1, overwriting the credentials for the Administrator account (user ID 1) and granting full wp-admin access.

Affected Systems

The flaw affects the My Calendar – Accessible Event Manager plugin for WordPress in all versions up to and including 3.8.7. WordPress sites that have activated the plugin and expose the default /my-calendar/ page are vulnerable. The issue is independent of other plugins or themes and does not depend on site configuration beyond default plugin activation.

Risk and Exploitability

The flaw has a CVSS score of 9.8, indicating critical severity. EPSS is not available, but the exploitation path is trivial: a public GET request to /my-calendar/?mcs=[my_calendar …] requires no authentication or special user state. The vulnerability is not listed in CISA KEV but it poses a high risk because it allows full administrative control over the WordPress installation, enabling compromise of site integrity, confidentiality, and availability.

Generated by OpenCVE AI on October 16, 2026 at 13:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the My Calendar plugin to version 3.8.8 or later, which removes the unsanitized handling of the 'mcs' parameter and enforces proper authorization checks.
  • If an immediate upgrade is not possible, temporarily block unauthenticated access to the /my-calendar/ endpoint by modifying the site's .htaccess or using a security plugin to restrict that URL to logged-in users.
  • As a containment measure, audit the current /my-calendar/ page to remove or sanitize the 'mcs' GET handling code, or apply a custom patch that sanitizes the parameter and enforces a callable allowlist for call_user_func.

Generated by OpenCVE AI on October 16, 2026 at 13:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Description The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.
Title My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-16T17:07:17.621Z

Reserved: 2026-10-02T13:12:10.980Z

Link: CVE-2026-104798

cve-icon Vulnrichment

Updated: 2026-10-16T16:48:57.521Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T05:17:28.580

Modified: 2026-10-16T18:17:20.360

Link: CVE-2026-104798

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T13:52:30Z

Weaknesses
  • CWE-269

    Improper Privilege Management