My Calendar EUVD-2026-102653

No special configuration is required: the My Calendar plugin auto-generates a /my-calendar/ page that is publicly accessible by default upon activation, giving an unauthenticated remote attacker a reflected entry point for the mcs GET parameter without any authentication, authorization, or user interaction. The only practical precondition is that the plugin (version ≤3.8.7) is installed and active, and that the targeted Administrator occupies user ID 1 - which is the standard default for the first/primary WordPress admin account, so this is rarely a limiting factor. The exploit depends on the unsanitized reflection running before WordPress core's do_shortcode filter and on mc_generate_calendar_nav() dispatching above elements through call_user_func() with no callable allowlist; there is no CAPTCHA, nonce, or capability check limiting exploitation.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) is fully corroborated by the description: the attack is network-reachable, requires no authentication, no user interaction, and low complexity, because the vulnerable /my-calendar/ page is auto-generated and publicly accessible by default on plugin activation. The technical impact is total - arbitrary PHP function invocation via unchecked call_user_func() leading to overwrite of the user ID 1 Administrator credentials - which justifies C:H/I:H/A:H and maps to a SSVC 'total' technical impact with likely 'automatable=yes' given the single-request, default-config trigger. No EPSS score, KEV listing, or POC flag was supplied in the input, so exploitation probability cannot be quantified from the data; per precision rules, there is no public exploit identified at time of analysis and no confirmation of active exploitation. The absence of KEV/EPSS does not lower the intrinsic risk: the signals that ARE present (unauthenticated, default-reachable, full admin takeover, trivially scriptable) point to very high real-world exploitability, and WordPress plugin privilege-escalation flaws of this class are historically mass-exploited shortly after disclosure. Treat as emergency-patch priority.

An unauthenticated attacker sends a single crafted GET request to the public /my-calendar/ page with a malicious mcs parameter that reflects a nested [my_calendar above=edit_user,...] shortcode into post content before do_shortcode runs. Because mc_generate_calendar_nav() splits the above attribute and dispatches each element through call_user_func() with no allowlist, the attacker coerces edit_user() to run against user ID 1, resetting the primary Administrator's credentials and seizing full wp-admin access. No public exploit was provided in the input data, but the attack is low-complexity and trivially scriptable given AV:N/AC:L/PR:N/UI:N.