My Calendar – Accessible Event Manager (<= 3.8.7)

The My Calendar WordPress plugin is vulnerable to unauthenticated privilege escalation via a reflected GET parameter that triggers arbitrary function calls, allowing attackers to overwrite administrator credentials.