EUVD-2026-30217
GHSA-r5x2-7wrx-jqfg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain authenticated WordPress account (custom-level or above)
-
DeliveryNavigate to My Calendar event submission form
-
ExploitCraft POST request with event_approved parameter set to target status (e.g., 1 for published)
-
ExecutionSubmit manipulated request directly, bypassing client-side UI restriction
-
PersistServer accepts POST-supplied status via mc_check_data()
-
ImpactEvent published or status altered without moderator approval
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated WordPress session with at minimum custom-level access (mapped to CVSS PR:L). The attacker must be able to submit events through the My Calendar event editor - meaning the event submission feature must be accessible to that user role. The bypass specifically targets the event_approved POST parameter, which the vulnerable code accepted to override server-side status logic. Exploitation is limited by the authentication requirement: unauthenticated or anonymous users cannot exploit this. Additionally, meaningful impact requires that the site actually enforces a moderation/approval workflow; on sites where all contributors can already publish freely, the bypass yields no practical advantage. The attack is not automatable at scale (SSVC: automatable: no) because each exploit requires an authenticated session tied to a specific account. |
| Impact | The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the limited real-world impact: network-reachable and low-complexity but requiring prior authentication (PR:L), with no confidentiality or availability impact and only partial integrity compromise. EPSS at 0.02% (4th percentile) is very low, consistent with SSVC's assessment of exploitation: none and automatable: no - the attack requires an authenticated session, meaning mass automated scanning is not a practical threat vector. This CVE is not in CISA KEV. The practical risk is narrowly scoped to sites where the event moderation/approval workflow is actively used as a governance mechanism: on such sites, a malicious contributor-level account could bypass editorial oversight and publish unauthorized content. For sites without a moderation workflow in use, the exploitable impact is functionally nil. This is a low-urgency patch rather than an emergency response priority. |
| Exploit ScenarioDerived | An authenticated WordPress user with a custom contributor-level account navigates to the event submission form and submits a new event. Using a proxy tool such as Burp Suite, the attacker intercepts the POST request and injects or modifies the event_approved field to a value of 1 (published) before forwarding it to the server. The server-side code in mc_check_data() accepts the attacker-supplied value and overrides the expected draft status, causing the event to publish immediately without passing through moderator review. No public exploit code has been identified, but the attack is straightforward for anyone familiar with HTTP request manipulation given the publicly documented source code references. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Authorization bypass in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.7.9) allows authenticated attackers with custom-level access or higher to circumvent the moderation and approval workflow by directly manipulating the POST body. The plugin's server-side PHP code in my-calendar-event-editor.php accepted the client-supplied event_approved parameter and used it to override the server-calculated event status, despite UI-level restrictions ostensibly limiting low-privilege users to draft-only submissions. Exploitation enables unauthorized event publishing, cancellation, or marking events private - integrity impacts limited to the event management workflow. No public exploit identified at time of analysis; EPSS (0.02%, 4th percentile) and SSVC (exploitation: none) both indicate negligible current exploitation interest.
RemediationAI
Update the My Calendar - Accessible Event Manager plugin beyond version 3.7.9. The upstream fix is confirmed in GitHub commit 98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4 and the corresponding WordPress SVN changeset (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3527861%40my-calendar&new=3527861%40my-calendar), which removes the vulnerable event_approved POST parameter handling from both mc_check_data() and my_calendar_save(). A specific released plugin version number beyond 3.7.9 is not independently confirmed from available data - verify the patched version via the WordPress plugin directory before deploying. As a compensating control where immediate upgrade is not possible, restrict WordPress site registration so that untrusted users cannot obtain even custom-level contributor accounts, reducing the authenticated attacker pool. If the moderation workflow is not actively used, the practical impact is already negligible.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in two functions within src/my-calendar-event-editor.php: mc_check_data() (lines ~2380-2384 in 3.7.9) and my_calendar_save() (lines ~792-796). Both functions contained legacy compatibility blocks - originally intended for older versions of My Calendar Pro - that conditionally reassigned the event approval status variable directly from $post['event_approved'] without any server-side authorization check against the submitting user's role. CWE-862 (Missing Authorization) applies precisely: the privilege enforcement existed only in the client-side UI (a submit button restricted to 'draft' mode for low-privilege users), with no corresponding server-side gate validating whether the user's role permitted the requested event_approved value. The CPE cpe:2.3:a:joedolson:my_calendar_-_accessible_event_manager is the affected product across all versions through 3.7.9. The fix, visible in commit 98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4, removes both legacy blocks entirely, eliminating the untrusted POST parameter from influencing event status.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The My Calendar - Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to bypass the moderation and approval workflow by tampering with the POST body to publish events or set other unauthorized statuses such as cancelled or private, in ways their role does not permit. While the UI correctly restricts low-privilege users to a draft-only submit button, this restriction is enforced only client-side, making it trivially bypassable by directly manipulating the POST request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB