Unauthenticated privilege escalation flaw in My Calendar WordPress plugin rated critical

The National Vulnerability Database lists CVE-2026-104798 as a critical security flaw in the My Calendar – Accessible Event Manager plugin for WordPress. This vulnerability allows unauthenticated attackers to escalate privileges and gain full administrative access to any WordPress site running the affected software. The issue affects all plugin versions up to and including 3.8.7.

The vulnerability stems from improper input sanitization in the plugin’s public interface. According to the NVD record, the public `mcs` GET parameter is reflected into post content without sanitization before WordPress core’s `do_shortcode` filter processes it. This allows attackers to inject a nested `[my_calendar above=...]` shortcode. The `mc_generate_calendar_nav()` function then splits the `above` attribute on commas and dispatches each element via `call_user_func()` without any authentication or authorization checks.

Technical context and exploitation path

The lack of a callable allowlist check enables unauthenticated attackers to invoke arbitrary loaded PHP functions. The NVD description details a specific call chain where the shortcode `$params` array is passed to the `edit_user()` function. PHP coerces this array to the integer `1`, which corresponds to the `$user_id` argument for the initial Administrator account. This process overwrites the credentials of user ID 1, granting the attacker immediate and full access to the WordPress administration dashboard.

Exploitation is described as trivially reachable because the plugin creates an auto-generated `/my-calendar/` page upon activation. This page is publicly accessible by default, meaning no prior login or user interaction is required to trigger the flaw. The National Vulnerability Database classifies the weakness under CWE-269, which relates to improper privilege management. The CVSS score of 9.8 reflects the severity of remote, unauthenticated access to the highest privilege level on the system.

Affected systems and scope

Only websites using the My Calendar – Accessible Event Manager plugin for WordPress are affected by this specific vulnerability. The NVD record explicitly states that all versions up to and including 3.8.7 are vulnerable. Sites running older versions of the plugin are also at risk. The vulnerability does not affect WordPress core itself, but rather the specific code within this third-party plugin. Administrators must verify their installed plugin version to determine if their site is exposed.

The default configuration of the plugin exacerbates the risk because the vulnerable endpoint is active and public immediately after installation. There is no mention of a mitigation or patch in the provided source material. Until a fix is confirmed and deployed, any site running these versions remains susceptible to the described privilege escalation attack.

What should you do?

Security professionals should audit their WordPress installations for the presence of the My Calendar plugin. If the plugin is installed, administrators must check the version number against the vulnerable range listed in the NVD record. Sites found to be running version 3.8.7 or earlier should be considered compromised until proven otherwise, given the ease of exploitation. Monitoring server logs for unusual requests to the `/my-calendar/` endpoint may help identify active scanning or exploitation attempts.

What to do and how to stay safe: My Calendar

• Audit your WordPress plugins to identify if My Calendar – Accessible Event Manager is installed and check its version number.
• If you are running version 3.8.7 or earlier, assume the site is vulnerable and monitor access logs for suspicious activity on the /my-calendar/ path.
• Review administrator account credentials and security logs for signs of unauthorized changes, as the flaw allows overwriting user ID 1.
• Wait for the vendor to release an official update or patch that addresses CVE-2026-104798 before restoring full trust in the plugin’s security posture.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-104798?

The National Vulnerability Database rates CVE-2026-104798 with a CVSS score of 9.8, which is classified as Critical.

Which versions of the My Calendar plugin are affected?

All versions of the My Calendar – Accessible Event Manager plugin up to and including version 3.8.7 are vulnerable to this flaw.

Can an attacker exploit this without logging in?

Yes, the vulnerability allows unauthenticated attackers to exploit the flaw via the publicly accessible /my-calendar/ page created by the plugin.