CVE-2026-104798

Name of the Vulnerable Software and Affected Versions My Calendar – Accessible Event Manager versions prior to 3.8.8

Description An unauthenticated attacker can achieve privilege escalation by exploiting the /my-calendar/ page. The issue occurs because the mcs GET parameter is reflected into post content without sanitization before the do shortcode filter is applied. This allows the injection of a nested [my calendar above=...] shortcode. The mc generate calendar nav() function then processes the above attribute and executes elements via call user func() without authentication or authorization checks. By invoking arbitrary PHP functions, an attacker can pass the $params array to edit user(), which PHP coerces to integer 1 for the $user id argument. This process overwrites the credentials of the primary Administrator account, granting the attacker full administrative access to the WordPress dashboard.

Recommendations Update the plugin to a version newer than 3.8.7. As a temporary mitigation, restrict public access to the /my-calendar/ page.