IT SBIT Services
Schneeberger
DEEN
CVE tracker

My Calendar: Unauthenticated privilege escalation via shortcode injection

CVE-2026-104798Critical 9.8

← All vulnerabilities

Summary

The My Calendar plugin for WordPress, up to and including 3.8.7 depending on the branch, lets unauthenticated attackers inject a nested shortcode through the public mcs GET parameter. The injected input causes arbitrary loaded PHP functions to be called, which can overwrite the credentials of the first Administrator account (user ID 1) and grant full wp-admin access. No login is required, and the vulnerable path is reachable through the plugin's auto-generated /my-calendar/ page, which is public by default after activation.

Affected

  • All versions up to and including 3.4.24
  • 3.5 to 3.5.21
  • 3.6 to 3.6.17
  • 3.7 to 3.7.17
  • 3.8 to 3.8.7

Fixed in

  • 3.8.8 (according to the WordPress.org changelog; not yet confirmed against the vendor advisory or the Wordfence record)
  • No fixed release found for the 3.4, 3.5, 3.6 and 3.7 branches. Treat them as unpatched.

Workaround

Unknown. No vendor workaround has been published. Deactivating the plugin removes the exposure but is not a vendor workaround.

Exploitation

  • CISA SSVC: exploitation none, automatable yes, technical impact total
  • Not listed in CISA KEV
  • No public proof of concept found
  • No reports of exploitation in the wild found

Our recommendation

  • Find all WordPress sites that run My Calendar, including older branches.
  • Update to the latest release from the vendor's site, not only 3.8.8. CVE-2026-119714 affects 3.8.8 before 3.8.11.
  • If a site cannot be updated immediately, deactivate the plugin.
  • Check user ID 1 and all administrator accounts for unexpected email, password or role changes, and review recent admin logins.
  • Re-check the Wordfence advisory and NVD, since NVD analysis is still pending.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:45.

Original description (NVD)

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.

NVD references (8)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed