The My Calendar – Accessible Event Manager plugin for WordPress contains an insecure direct object reference that allows an unauthenticated attacker to supply an arbitrary value for the 'vcal' parameter. Because the plugin does not validate or sanitize that parameter, the attacker can manipulate it to reference any event identifier. When the request is processed, the plugin returns a full iCalendar (.ics) export for the targeted event, even if that event is marked private, draft, trashed, or otherwise restricted. The exported data reveals sensitive event metadata such as titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata, effectively leaking information that should be protected.

All installations of the My Calendar – Accessible Event Manager plugin with a version of 3.7.14 or earlier are affected. The vulnerability is located in the core plugin code that handles iCalendar export via the 'vcal' parameter and requires no special site configuration to be exploited.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, attackers can exploit this flaw remotely by sending crafted HTTP GET requests that include a manipulated 'vcal' parameter. No authentication or privileged access is required, and the exploitation does not lead to code execution or broader system compromise.