Unauthenticated Privilege Escalation in My Calendar WordPress Plugin

The My Calendar - Accessible Event Manager plugin for WordPress, in versions 3.8.7 and earlier, contains a critical vulnerability (CVE-2026-104798) that permits unauthenticated privilege escalation. The vulnerability stems from an unsanitized reflected GET parameter, 'mcs', which is processed by the plugin before WordPress executes shortcode filtering. An attacker can inject a nested '[my_calendar]' shortcode, which subsequently triggers 'mc_generate_calendar_nav()'. This function improperly handles the 'above' attribute, splitting values by commas and passing them to 'call_user_func()' without any authorization or allowlist validation.

By crafting a malicious request, an attacker can invoke arbitrary PHP functions. A common exploitation chain involves targeting the 'edit_user()' function. Because the attacker-controlled shortcode parameters are passed to this function, PHP coercion can force the user ID argument to '1', effectively overwriting the administrator account credentials. Given that the default plugin page is often publicly accessible, this vulnerability provides a trivial path to full site administrative takeover.

Attack Chain

1. The attacker identifies a WordPress site with the My Calendar plugin installed and enabled.
2. The attacker navigates to the public '/my-calendar/' page.
3. The attacker submits a crafted HTTP GET request containing the malicious 'mcs' parameter.
4. The plugin reflects the 'mcs' parameter into the application content without sanitization.
5. The WordPress environment executes 'do_shortcode', which processes the attacker-injected nested shortcode.
6. The 'mc_generate_calendar_nav()' function executes and splits the 'above' attribute.
7. 'call_user_func()' executes the attacker-defined function (e.g., 'edit_user') with malicious parameters.
8. The WordPress administrative account (user ID 1) is modified, granting the attacker full 'wp-admin' access.

Impact

Successful exploitation results in full administrative compromise of the affected WordPress site. Because the vulnerability targets the site administrator (User ID 1), attackers gain complete control over site configuration, content, themes, and plugins. This impact is universal across all vulnerable installations where the plugin's default page remains published.

Recommendation

• Immediately update the My Calendar - Accessible Event Manager plugin to a version later than 3.8.7.
• Audit WordPress user activity logs for unauthorized modifications to the administrative account (User ID 1), particularly via the 'edit_user' or 'wp_update_user' functions.
• Use the provided webserver detection rule to identify and block incoming malicious requests containing the 'mcs' injection pattern.
• Restrict public access to the '/my-calendar/' page or disable the plugin until a patch is applied if immediate updating is not possible.