The My Calendar – Accessible Event Manager plugin for WordPress suffers from an insecure direct object reference that lets unauthenticated users pass any value to the 'vcal' parameter. Because the plugin does not validate or sanitize this parameter, an attacker can reference the internal identifiers of events that are private, draft, trashed, or otherwise restricted. When the request is processed the plugin outputs a complete iCalendar (.ics) file for that event, revealing titles, descriptions, dates, locations, organizer and host details, permalinks, and other sensitive calendar metadata. This flaw stems from CWE‑639, the lack of proper input validation for user‑supplied data.

All installations of the My Calendar – Accessible Event Manager plugin with a version of 3.7.14 or earlier are affected. The vulnerability is located in the core plugin code that handles iCalendar export via the 'vcal' parameter and requires no special site configuration to be exploited.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, attackers can exploit this flaw remotely by sending crafted HTTP GET requests that include a manipulated 'vcal' parameter. No authentication or privileged access is required, and the exploitation does not lead to code execution or broader system compromise.