What is the CVSS score of CVE-2026-6854?

CVE-2026-6854 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of My Calendar are affected by CVE-2026-6854?

The My Calendar - Accessible Event Manager WordPress plugin (versions ≤3.7.8) contains an unauthenticated SQL injection vulnerability enabling attackers to extract user credentials and security keys…

Is there a public PoC exploit available for CVE-2026-6854?

Yes, a public proof-of-concept exploit is available for CVE-2026-6854. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-6854?

Within 24 hours: identify all WordPress sites running My Calendar plugin ≤3.7.8; immediately disable or remove the plugin; if immediate removal is not possible, block access to the plugin directory via Web Application Firewall. Within 7 days: review WordPress and database audit logs for unauthorized SQL queries; assess whether database contents were accessed. Within 30 days: monitor vendor advisory for patched version; when available, update to the first patched release; alternatively, replace with a maintained calendar alternative.

My Calendar CVE-2026-6854

EUVD-2026-42218 HIGH

SQL Injection (CWE-89)

2026-07-08 Wordfence

GHSA-r6mh-qhp6-q734

WordPress SQLi Wordpress Plugin My Calendar Accessible Event Manager Joedolson

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable parameter (AV:N/PR:N/UI:N/AC:L); blind SQLi yields database read (C:H) but no direct write or availability loss (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:36 vuln.today

CVE Published

Jul 08, 2026 - 11:30 nvd

HIGH 7.5

DescriptionCVE.org

The My Calendar - Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Articles & Coverage 1

medium.com Reverse Engineering CVE-2026-6854: A Beginner's Walkthrough of Exploit Analysis Aug 14, 2026

AnalysisAI

Unauthenticated blind SQL injection in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.7.8) lets remote attackers inject SQL through the 'mc_auth' parameter, enabling extraction of sensitive database contents such as user credentials and secret keys. The flaw stems from unescaped user input concatenated into an unprepared query, and being reachable without authentication makes it broadly exploitable on any site running a vulnerable version. No public exploit identified at time of analysis, but the technique (time-based blind extraction) is well understood and readily automatable.

Technical ContextAI

The affected component is My Calendar (vendor slug joedolson), a widely used WordPress event-management plugin (CPE cpe:2.3:a:joedolson:my_calendar_-_accessible_event_manager). The root cause is CWE-89 (SQL Injection): the plugin passes the 'mc_auth' request parameter into an existing SQL statement without applying WordPress's $wpdb->prepare() placeholders and without escaping, so attacker-controlled text becomes part of the query string. Because the injection is 'time-based blind', the query returns no direct data - the attacker infers results one bit at a time by injecting conditional SLEEP()/delay expressions and measuring server response latency, which works even when the endpoint suppresses errors and echoes no query output.

RemediationAI

Upstream fix available (WordPress.org plugin changeset 3515996); a released patched version is not independently confirmed in the available data, but since all versions through 3.7.8 are affected the fix ships in the next release (expected 3.7.9 or later) - update My Calendar to the latest available version from the WordPress plugin repository and verify the running version is above 3.7.8. Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/aa1ed81c-04cb-4ccd-8c30-b1d943730909?source=cve) and the code change (https://plugins.trac.wordpress.org/changeset/3515996/my-calendar) before deploying. If immediate patching is not possible, deploy a WAF rule to block SQLi patterns targeting the 'mc_auth' request parameter (side effect: pattern-based rules can be bypassed and may cause false positives on legitimate values), restrict access to the vulnerable endpoint at the web-server or firewall level where feasible, and consider temporarily deactivating the plugin if the calendar functionality is non-essential (side effect: removes event-management features and any front-end calendars from the site).