My Calendar EUVD-2026-42218

Exploitation requires only that the target WordPress site have the My Calendar - Accessible Event Manager plugin installed and active at any version up to and including 3.7.8, with the request-handling code path that consumes the 'mc_auth' parameter reachable over the network. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so there are no special conditions - remote unauthenticated exploitation works against default configurations of My Calendar; no login, no user interaction, and no non-default setting are needed. The primary limiting factors are simply that the plugin must be present and at a vulnerable version (≤3.7.8) and the parameter endpoint must not be blocked by an intervening WAF or access control; time-based blind extraction is also comparatively slow, which limits data-exfiltration speed but not feasibility.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 7.5) signals a genuinely low bar: network-reachable, low complexity, no privileges, no user interaction, with high confidentiality impact and no integrity or availability impact - consistent with a read-only data-extraction SQLi. This is a real triage priority for exposed WordPress sites: unauthenticated + automatable + a popular plugin is exactly the profile that gets mass-scanned once details circulate. That said, exploitation is not confirmed active: there is no CISA KEV listing and no public POC in the provided data, so this is potential rather than observed exploitation. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified here; the assessment rests on the CVSS profile and the intrinsic ease of automating blind SQLi. Note the confidentiality-only impact - an attacker reads data but does not directly gain write/RCE, so severity is high but not critical.

An attacker scans the internet for WordPress sites running My Calendar ≤3.7.8 and, without any login, sends crafted requests supplying a time-based blind SQL payload in the 'mc_auth' parameter. By injecting conditional delay expressions and measuring response times, the attacker iteratively extracts administrator password hashes, session/auth secrets, and other sensitive rows from the WordPress database. No public POC is identified at time of analysis, but the attack is fully automatable with standard tooling such as sqlmap.