CVE-2026-40308 Details
Description
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.
A vulnerability in the My Calendar WordPress plugin, affecting versions through 3.7.6, allows unauthenticated users to exploit the mc_ajax_mcjs_action AJAX endpoint. This endpoint, available to all users, improperly validates user-supplied arguments, enabling the injection of arbitrary parameters, including site IDs. On WordPress Multisite installations, this flaw permits unauthorized attackers to use switch_to_blog() with any site ID, accessing calendar events from any sub-site, including private events. Conversely, on Single Site installations, the absence of switch_to_blog() leads to a PHP fatal error, crashing the worker thread and causing a denial-of-service condition.
Users are advised to update the My Calendar WordPress plugin to version 3.7.7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 16, 2026CISA-ADP
Assessed Apr 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/joedolson/my-calendar/releases/tag/v3.7.7 | [email protected] | Release NotesVendor |
| https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| joedolson my-calendar | <= 3.7.6 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |