CVE-2026-7525 Details
Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to bypass the moderation and approval workflow by tampering with the POST body to publish events or set other unauthorized statuses such as cancelled or private, in ways their role does not permit. While the UI correctly restricts low-privilege users to a draft-only submit button, this restriction is enforced only client-side, making it trivially bypassable by directly manipulating the POST request.
A vulnerability exists in the My Calendar – Accessible Event Manager plugin for WordPress, affecting all versions up to and including 3.7.9. The issue stems from the plugin's failure to properly verify user authorization for certain actions. This flaw enables authenticated attackers with custom-level access or higher to bypass the normal moderation and approval processes. Exploitation involves manipulating the POST request to publish events or change event statuses to unauthorized options like 'cancelled' or 'private', contrary to the permissions of their assigned role. Although the user interface restricts lower-privilege users to saving drafts, this limitation is only enforced on the client side, leaving it vulnerable to bypass via direct POST request modifications.
Users are advised to update the My Calendar – Accessible Event Manager plugin to version 3.7.10 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| My Calendar | <= 3.7.9 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |