The vulnerability is an injection flaw in the mc_ajax_mcjs_action AJAX endpoint, which accepts user‑supplied arguments without validation and passes them to parse_str(). An unauthenticated attacker can supply a particular site ID value, causing WordPress to invoke switch_to_blog() and switch context to any sub‑site on a Multisite network. This grants the attacker read access to calendar events that may be marked as private or hidden. On single‑site setups, the same call triggers a fatal PHP error, resulting in an unauthenticated denial of service. The flaw is an instance of CWE‑639, an Insecure Direct Object Reference error.

The affected product is the My Calendar WordPress plugin developed by joedolson. Versions up to and including 3.7.6 are vulnerable. The issue manifests on WordPress Multisite networks, where it permits cross‑site data exposure, and on single‑site installations, where it causes a crash if the endpoint is accessed.

The vulnerability has a fixed CVSS score of 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending unauthenticated HTTP requests to the exposed AJAX endpoint present in all WordPress installations that host the plugin. No authentication or special privileges are required, making the attack path straightforward for any entity with network access to the site. The exploit facilitates the extraction of private calendar data from any sub‑site in a Multisite network, thereby compromising confidentiality and potentially enabling further reconnaissance or lateral movement.