EUVD-2026-23306
GHSA-2mvx-f5qm-v2ch
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint with no UI (AV:N/AC:L/PR:N/UI:N); cross-tenant event disclosure gives C:H and worker crash gives A:H; no integrity impact and shared WordPress app keeps S:U.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.
AnalysisAI
Unauthenticated information disclosure (IDOR) in the My Calendar WordPress plugin (versions ≤ 3.7.6) lets remote attackers read calendar events-including private and hidden ones-from any sub-site on a WordPress Multisite network by injecting an arbitrary site ID into the unauthenticated mcjs_action AJAX endpoint. On Single Site installations the same request triggers an uncaught fatal error, giving an unauthenticated denial-of-service vector. Publicly available exploit code exists, though EPSS remains very low (0.01%) and the flaw is not in CISA KEV. Fixed in version 3.7.7.
Technical ContextAI
The plugin registers mc_ajax_mcjs_action to the wp_ajax_nopriv_mcjs_action hook, making it reachable by unauthenticated users. When behavior=loadupcoming, the handler takes the attacker-controlled args string and (after sanitize_text_field and a '|'→'&' substitution) passes it directly to PHP's parse_str(), which populates a $args array with arbitrary attacker-supplied key-value pairs. That array flows into my_calendar_upcoming_events() in my-calendar-widgets.php, where a supplied 'site' value is passed straight to WordPress core's switch_to_blog($args['site']) with no capability check (e.g., no Super Admin / manage_network verification). This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the sub-site identifier is a direct object reference the application trusts without authorization. The affected component is joedolson/my-calendar (CPE cpe:2.3:a:joedolson:my-calendar:*), and the behavior diverges by deployment: on Multisite, switch_to_blog() exists and changes DB context to the targeted tenant; on Single Site it is undefined, so the call fatals with 'Call to undefined function switch_to_blog()'.
RemediationAI
Vendor-released patch: 3.7.7-upgrade the My Calendar plugin to version 3.7.7 or later, which fixes the unvalidated switch_to_blog() call (release: https://github.com/joedolson/my-calendar/releases/tag/v3.7.7; advisory: https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch). If immediate patching is not possible, compensating controls include blocking or restricting unauthenticated access to the wp-admin/admin-ajax.php endpoint for action=mcjs_action at a WAF or reverse proxy-note this may break legitimate front-end 'upcoming events' AJAX loading for anonymous visitors; adding a WAF rule to reject requests whose args parameter contains a 'site' key mitigates the IDOR/switch_to_blog path with less functional impact; and on Single Site installs, rate-limiting admin-ajax.php requests reduces the DoS exposure but does not eliminate the fatal-error trigger. Disabling the plugin entirely is the only complete workaround until 3.7.7 is applied, at the cost of losing calendar functionality.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today