What is the CVSS score of CVE-2026-11896?

CVE-2026-11896 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

My Calendar CVE-2026-11896

EUVD-2026-41266 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-02 Wordfence

GHSA-rfww-46mr-4mrf

WordPress Authentication Bypass Wordpress Plugin My Calendar Accessible Event Manager Joedolson

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible endpoint requires no authentication or interaction; impact limited to low confidentiality (metadata only), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 10:18 vuln.today

CVE Published

Jul 02, 2026 - 08:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The My Calendar - Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.

AnalysisAI

Insecure Direct Object Reference in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.7.14) exposes non-public, draft, trashed, and personal calendar events to unauthenticated remote attackers via the 'vcal' iCalendar export endpoint. By enumerating integer occurrence IDs in the 'vcal' parameter, an attacker can retrieve full iCalendar exports containing event titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata that site owners explicitly withheld from public view. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and zero authentication requirement make opportunistic enumeration trivially feasible.

Technical ContextAI

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's iCalendar export handler accepts a user-supplied 'vcal' parameter as a direct database lookup key without verifying whether the requesting user is authorized to view the referenced event. Wordfence's source references pinpoint the vulnerable logic across my-calendar-api.php (lines 212, 246), my-calendar-events.php (line 748), includes/ical.php (line 26), and includes/date-utilities.php (line 417) in the 3.7.14 tag. The iCal export function serializes WordPress post objects regardless of their post_status (draft, trash, private, personal), bypassing WordPress's normal visibility controls. The CPE string cpe:2.3:a:joedolson:my_calendar_-_accessible_event_manager:*:*:*:*:*:*:*:* confirms the affected product is the 'My Calendar' plugin authored by joedolson on the WordPress.org plugin repository.

RemediationAI

Upstream fix available (commit/changeset 3572191 on the WordPress plugin Trac repository at https://plugins.trac.wordpress.org/changeset?old=3572191%40my-calendar&new=3572191%40my-calendar); a released patched version number is not independently confirmed from available data, so administrators should update to the latest available version beyond 3.7.14 via the WordPress dashboard or WP-CLI as soon as a new release is published. As a compensating control while awaiting the update, administrators can disable the iCalendar/vcal export feature within the My Calendar plugin settings if the feature is not required - this eliminates the exposed endpoint entirely with no impact on standard calendar display functionality. Alternatively, WAF rules can be deployed to block or rate-limit requests to URLs containing the 'vcal' parameter. Sites that do not use non-public (draft, trashed, or personal) calendar events face no meaningful risk from this vulnerability and may defer the update to normal patching cycles.