{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amy_calendar_projectmy_calendarwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:my_calendar_project:my_calendar:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-104798"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["My Calendar – Accessible Event Manager (\u003c= 3.8.7)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe My Calendar - Accessible Event Manager plugin for WordPress, in versions 3.8.7 and earlier, contains a critical vulnerability (CVE-2026-104798) that permits unauthenticated privilege escalation. The vulnerability stems from an unsanitized reflected GET parameter, 'mcs', which is processed by the plugin before WordPress executes shortcode filtering. An attacker can inject a nested '[my_calendar]' shortcode, which subsequently triggers 'mc_generate_calendar_nav()'. This function improperly handles the 'above' attribute, splitting values by commas and passing them to 'call_user_func()' without any authorization or allowlist validation.\u003c/p\u003e\n\u003cp\u003eBy crafting a malicious request, an attacker can invoke arbitrary PHP functions. A common exploitation chain involves targeting the 'edit_user()' function. Because the attacker-controlled shortcode parameters are passed to this function, PHP coercion can force the user ID argument to '1', effectively overwriting the administrator account credentials. Given that the default plugin page is often publicly accessible, this vulnerability provides a trivial path to full site administrative takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a WordPress site with the My Calendar plugin installed and enabled.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the public '/my-calendar/' page.\u003c/li\u003e\n\u003cli\u003eThe attacker submits a crafted HTTP GET request containing the malicious 'mcs' parameter.\u003c/li\u003e\n\u003cli\u003eThe plugin reflects the 'mcs' parameter into the application content without sanitization.\u003c/li\u003e\n\u003cli\u003eThe WordPress environment executes 'do_shortcode', which processes the attacker-injected nested shortcode.\u003c/li\u003e\n\u003cli\u003eThe 'mc_generate_calendar_nav()' function executes and splits the 'above' attribute.\u003c/li\u003e\n\u003cli\u003e'call_user_func()' executes the attacker-defined function (e.g., 'edit_user') with malicious parameters.\u003c/li\u003e\n\u003cli\u003eThe WordPress administrative account (user ID 1) is modified, granting the attacker full 'wp-admin' access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative compromise of the affected WordPress site. Because the vulnerability targets the site administrator (User ID 1), attackers gain complete control over site configuration, content, themes, and plugins. This impact is universal across all vulnerable installations where the plugin's default page remains published.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the My Calendar - Accessible Event Manager plugin to a version later than 3.8.7.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user activity logs for unauthorized modifications to the administrative account (User ID 1), particularly via the 'edit_user' or 'wp_update_user' functions.\u003c/li\u003e\n\u003cli\u003eUse the provided webserver detection rule to identify and block incoming malicious requests containing the 'mcs' injection pattern.\u003c/li\u003e\n\u003cli\u003eRestrict public access to the '/my-calendar/' page or disable the plugin until a patch is applied if immediate updating is not possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:24:26Z","date_published":"2026-10-16T06:24:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-my-calendar-priv-esc/","summary":"The My Calendar WordPress plugin is vulnerable to unauthenticated privilege escalation via a reflected GET parameter that triggers arbitrary function calls, allowing attackers to overwrite administrator credentials.","title":"Unauthenticated Privilege Escalation in My Calendar WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-my-calendar-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:my_calendar_project:my_calendar:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}