EUVD-2026-41266
GHSA-rfww-46mr-4mrf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with My Calendar plugin
-
DeliverySend GET request with 'vcal' parameter set to integer occurrence IDs
-
ExploitBypass authorization check in iCal export handler
-
ExecutionRetrieve full iCalendar export of non-public event
-
ImpactExtract sensitive metadata (titles, descriptions, locations, organizer details)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | The My Calendar - Accessible Event Manager plugin must be installed and active on the WordPress site, running version 3.7.14 or earlier. The iCalendar export endpoint ('vcal' parameter) must be reachable from the attacker's network - standard for public-facing WordPress installations. Sensitive data exposure is limited to events that exist in non-public states (draft, trashed, or personal); sites where all calendar events are already public face no additional confidentiality risk. No authentication is required, and no special configuration beyond plugin activation is needed. Exploitation is limited to information disclosure only - no write access or code execution is possible through this vector. The attack is further constrained by the need to enumerate occurrence IDs, which are integers and enumerable but require active iteration rather than a single-shot exploit. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), accurately reflecting network-reachable, zero-authentication exploitation with limited confidentiality impact (event metadata, not credentials or filesystem content). The attack complexity is genuinely low: occurrence IDs are predictable sequential integers, making enumeration trivial with no tooling beyond a simple script or even a browser. However, real-world impact is scoped strictly to information disclosure - there is no integrity or availability impact, and the confidentiality exposure is bounded to calendar event metadata rather than authentication secrets or PII beyond what organizers stored in event fields. No EPSS score is present in the provided data. The vulnerability is absent from CISA KEV and no public exploit code has been confirmed, keeping immediate mass-exploitation risk lower than raw CVSS suggests. The primary concern is targeted reconnaissance: an attacker enumerating draft events on a legal firm's, medical practice's, or private organization's WordPress site could extract operationally sensitive scheduling information. The 'Authentication Bypass' tag in the source intelligence is misleading - this is not an authentication bypass but an authorization control omission on a public-facing API endpoint. |
| Exploit ScenarioDerived | An unauthenticated attacker sends sequential HTTP GET requests to the target WordPress site appending incrementing integer values to the 'vcal' parameter (e.g., /?vcal=1, /?vcal=2, …) and receives valid iCalendar (.ics) formatted responses containing full event details for non-public events. This automated enumeration requires no credentials, no prior reconnaissance beyond confirming the plugin is installed, and can be scripted in minutes to harvest all private event metadata from a target site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 02, 2026
Insecure Direct Object Reference in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.7.14) exposes non-public, draft, trashed, and personal calendar events to unauthenticated remote attackers via the 'vcal' iCalendar export endpoint. By enumerating integer occurrence IDs in the 'vcal' parameter, an attacker can retrieve full iCalendar exports containing event titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata that site owners explicitly withheld from public view. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and zero authentication requirement make opportunistic enumeration trivially feasible.
RemediationAI
Upstream fix available (commit/changeset 3572191 on the WordPress plugin Trac repository at https://plugins.trac.wordpress.org/changeset?old=3572191%40my-calendar&new=3572191%40my-calendar); a released patched version number is not independently confirmed from available data, so administrators should update to the latest available version beyond 3.7.14 via the WordPress dashboard or WP-CLI as soon as a new release is published. As a compensating control while awaiting the update, administrators can disable the iCalendar/vcal export feature within the My Calendar plugin settings if the feature is not required - this eliminates the exposed endpoint entirely with no impact on standard calendar display functionality. Alternatively, WAF rules can be deployed to block or rate-limit requests to URLs containing the 'vcal' parameter. Sites that do not use non-public (draft, trashed, or personal) calendar events face no meaningful risk from this vulnerability and may defer the update to normal patching cycles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's iCalendar export handler accepts a user-supplied 'vcal' parameter as a direct database lookup key without verifying whether the requesting user is authorized to view the referenced event. Wordfence's source references pinpoint the vulnerable logic across my-calendar-api.php (lines 212, 246), my-calendar-events.php (line 748), includes/ical.php (line 26), and includes/date-utilities.php (line 417) in the 3.7.14 tag. The iCal export function serializes WordPress post objects regardless of their post_status (draft, trash, private, personal), bypassing WordPress's normal visibility controls. The CPE string cpe:2.3:a:joedolson:my_calendar_-_accessible_event_manager:*:*:*:*:*:*:*:* confirms the affected product is the 'My Calendar' plugin authored by joedolson on the WordPress.org plugin repository.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible endpoint requires no authentication or interaction; impact limited to low confidentiality (metadata only), with no integrity or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The My Calendar - Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB