CVE-2026-104798 Details

A privilege escalation vulnerability has been identified in the My Calendar – Accessible Event Manager plugin for WordPress, affecting all versions through 3.8.7. The vulnerability arises because the public 'mcs' GET parameter is reflected into post content without proper sanitization, before being processed by WordPress's 'do_shortcode' filter. This allows an unauthenticated attacker to inject a nested '[my_calendar above=...]' shortcode. The 'mc_generate_calendar_nav()' function then splits the 'above' attribute by commas and executes each element as a PHP function, without any authentication, authorization, or validation checks. This exploitation chain enables attackers to invoke arbitrary PHP functions, ultimately allowing them to overwrite the credentials of the WordPress Administrator account with user ID 1, granting full access to the wp-admin area. The vulnerability can be easily exploited through the plugin's default '/my-calendar/' page, which is publicly accessible after activation.

Users are advised to update the My Calendar – Accessible Event Manager plugin to version 3.8.8 or any of the following versions: 3.4.25, 3.5.22, 3.6.18, 3.7.18.