{"id":"CVE-2026-104798","published":"2026-10-16T05:17:28.580","lastModified":"2026-10-16T18:17:20.360","description":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-output.php#L1622","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L170","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L221","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-shortcodes.php#L102","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3746389%40my-calendar&new=3746389%40my-calendar","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The My Calendar plugin allows unauthenticated attackers to inject a nested shortcode that triggers arbitrary PHP function calls, enabling privilege escalation to administrator level by overwriting the admin user's credentials. This vulnerability exists due to insufficient sanitization of the 'mcs' parameter and lack of authentication checks before executing user-supplied functions.","exploitability":"Exploitation is trivially easy with no preconditions required, as attackers can simply call the public /my-calendar/ page with a crafted 'mcs' parameter to trigger the vulnerability.","blast_radius":"The impact is critical across all WordPress sites using the My Calendar plugin version 3.8.7 or earlier, potentially compromising entire sites with full administrative access for attackers.","remediation":"Upgrade to version 3.8.8 or later which contains the fix for this privilege escalation vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","shortcode","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:51.500Z"}}