CVE-2026-6854

Name of the Vulnerable Software and Affected Versions My Calendar – Accessible Event Manager versions prior to 3.7.9

Description An issue exists where unauthenticated attackers can perform time-based blind SQL Injection. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. By manipulating the mc auth parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

Recommendations Update the plugin to version 3.7.9 or later. As a temporary mitigation, restrict access to the functionality utilizing the mc auth parameter.