My Calendar EUVD-2026-23306

Exploitation requires the My Calendar plugin ≤ 3.7.6 active and reachable at wp-admin/admin-ajax.php, with the request using action=mcjs_action and behavior=loadupcoming plus an args string containing an injected 'site' key (the '|' character is converted to '&' before parse_str, so parameters can be packed into args). No authentication, user interaction, or non-default plugin configuration is needed-the wp_ajax_nopriv_mcjs_action hook exposes it to anonymous users by default. The decisive limiting factor is deployment topology: the cross-tenant information disclosure (reading events from arbitrary sub-sites) only works on WordPress Multisite networks where switch_to_blog() exists; on Single Site installations that function is undefined, so the exact same request yields only an unauthenticated denial of service (500 fatal error) rather than data disclosure.

The signals conflict and should be weighed rather than taken at face value. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VA:H) and SSVC (Exploitation: poc, Automatable: yes, Technical Impact: total) both point to an easy, scriptable, unauthenticated attack with serious impact-consistent with the 8.8 score. Publicly available exploit code raises practical concern. However, EPSS is only 0.01% (3rd percentile) and the vulnerability is NOT in CISA KEV, indicating no observed mass exploitation to date. The confidentiality impact (cross-tenant event disclosure) applies ONLY to WordPress Multisite deployments, which are a minority of installs; on far more common Single Site installs the impact is limited to DoS, not data theft. So the 'total' technical impact and VC:H are conditional on a Multisite topology. Net: a genuine, low-effort issue worth prompt patching-especially for Multisite hosts and multi-tenant platforms-but the low EPSS and absence from KEV suggest opportunistic rather than widespread active exploitation at this time.

An unauthenticated attacker sends a crafted POST to admin-ajax.php with action=mcjs_action, behavior=loadupcoming, and an args string carrying an injected site parameter (e.g., site=2). On a Multisite network, the plugin switches DB context to sub-site 2 and returns its calendar events-including private ones-in the JSON response, letting the attacker enumerate site IDs and harvest events across tenants. Public exploit code exists and the attack is scriptable/automatable; against a Single Site target the same request instead crashes the PHP worker for an unauthenticated DoS.