The My Calendar plugin for WordPress lacks proper server‑side authorization checks on event approval parameters. An attacker who is logged in with a custom‑level or higher role can modify the POST body to set the event_approved flag or other status fields such as cancelled or private. Because the user interface performs the role check only on the client side, the server accepts the altered values without verification, allowing the attacker to publish, cancel, or privatize events that their role normally cannot manage. The vulnerability does not provide direct remote code execution but can lead to data integrity violations, undesired scheduling, and potential loss of trust in the event system.

WordPress sites running the My Calendar – Accessible Event Manager plugin, version 3.7.9 or older. All users with at least a custom‑level role—typically administrators, editors, and similar privileged users—are impacted.

The CVSS score of 4.3 indicates moderate severity. The exploit requires authenticated access with a custom‑level or higher role; no known public exploit is listed in KEV, and EPSS score is not available. Because the plugin performs no server‑side validation, the attack remains feasible as soon as a user with sufficient privileges gains network access to the site. The risk primarily affects event integrity and availability on sites that rely on the approval workflow for scheduling.