Skip to content
Threat Feed
Subscribe

Product

My Calendar - Accessible Event Manager Plugin <= 3.7.8

1 brief RSS
high advisory

CVE-2026-6854 - WordPress My Calendar Plugin Time-Based Blind SQL Injection

A time-based blind SQL Injection vulnerability exists in the My Calendar - Accessible Event Manager plugin for WordPress, affecting all versions up to and including 3.7.8. This flaw, located in the 'mc_auth' parameter, stems from insufficient input sanitization and improper SQL query preparation, allowing unauthenticated attackers to inject additional SQL queries to extract sensitive information from the underlying database.

My Calendar - Accessible Event Manager plugin <= 3.7.8 wordpress sql-injection vulnerability web-application collection initial-access
1r 2t 1c