What is the CVSS score of EUVD-2026-30217?

EUVD-2026-30217 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

My Calendar EUVD-2026-30217

| CVE-2026-7525 MEDIUM

Missing Authorization (CWE-862)

2026-05-14 Wordfence

GHSA-r5x2-7wrx-jqfg

WordPress Authentication Bypass Wordpress Plugin My Calendar Accessible Event Manager Joedolson

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 10:53 vuln.today

Analysis Generated

Jun 08, 2026 - 10:53 vuln.today

CVE Published

May 14, 2026 - 03:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The My Calendar - Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to bypass the moderation and approval workflow by tampering with the POST body to publish events or set other unauthorized statuses such as cancelled or private, in ways their role does not permit. While the UI correctly restricts low-privilege users to a draft-only submit button, this restriction is enforced only client-side, making it trivially bypassable by directly manipulating the POST request.

AnalysisAI

Authorization bypass in the My Calendar - Accessible Event Manager WordPress plugin (all versions through 3.7.9) allows authenticated attackers with custom-level access or higher to circumvent the moderation and approval workflow by directly manipulating the POST body. The plugin's server-side PHP code in my-calendar-event-editor.php accepted the client-supplied event_approved parameter and used it to override the server-calculated event status, despite UI-level restrictions ostensibly limiting low-privilege users to draft-only submissions. Exploitation enables unauthorized event publishing, cancellation, or marking events private - integrity impacts limited to the event management workflow. No public exploit identified at time of analysis; EPSS (0.02%, 4th percentile) and SSVC (exploitation: none) both indicate negligible current exploitation interest.

Technical ContextAI

The vulnerability resides in two functions within src/my-calendar-event-editor.php: mc_check_data() (lines ~2380-2384 in 3.7.9) and my_calendar_save() (lines ~792-796). Both functions contained legacy compatibility blocks - originally intended for older versions of My Calendar Pro - that conditionally reassigned the event approval status variable directly from $post['event_approved'] without any server-side authorization check against the submitting user's role. CWE-862 (Missing Authorization) applies precisely: the privilege enforcement existed only in the client-side UI (a submit button restricted to 'draft' mode for low-privilege users), with no corresponding server-side gate validating whether the user's role permitted the requested event_approved value. The CPE cpe:2.3:a:joedolson:my_calendar_-_accessible_event_manager is the affected product across all versions through 3.7.9. The fix, visible in commit 98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4, removes both legacy blocks entirely, eliminating the untrusted POST parameter from influencing event status.

RemediationAI

Update the My Calendar - Accessible Event Manager plugin beyond version 3.7.9. The upstream fix is confirmed in GitHub commit 98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4 and the corresponding WordPress SVN changeset (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3527861%40my-calendar&new=3527861%40my-calendar), which removes the vulnerable event_approved POST parameter handling from both mc_check_data() and my_calendar_save(). A specific released plugin version number beyond 3.7.9 is not independently confirmed from available data - verify the patched version via the WordPress plugin directory before deploying. As a compensating control where immediate upgrade is not possible, restrict WordPress site registration so that untrusted users cannot obtain even custom-level contributor accounts, reducing the authenticated attacker pool. If the moderation workflow is not actively used, the practical impact is already negligible.