CVE-2026-104798 joedolson CVE debrief

Who should care

WordPress administrators and users of the My Calendar – Accessible Event Manager plugin should assess their exposure and take immediate action to update the plugin to a version that is not vulnerable.

Why it matters

CVE-2026-104798 is a critical vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress, allowing an unauthenticated attacker to escalate privileges and gain full access to the WordPress administration interface. WordPress administrators and users of the plugin should assess their exposure and take immediate action to update the plugin to a version that is not vulnerable.

• An unauthenticated attacker can inject a nested shortcode to invoke arbitrary loaded PHP functions
• The attacker can overwrite the credentials of the initial Administrator account (user ID 1) and gain full wp-admin access
• The vulnerability can be exploited via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation
• Verification of the plugin's shortcode functionality and input sanitization is necessary to prevent exploitation

Technical summary

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check.

Defensive priority

High

Recommended defensive actions

• Update the My Calendar – Accessible Event Manager plugin to a version that is not vulnerable
• Monitor the plugin's auto-generated `/my-calendar/` page for suspicious activity
• Verify that the plugin's shortcode functionality is properly sanitized and validated
• Perform a thorough review of the plugin's codebase to identify potential vulnerabilities
• Implement additional security measures, such as web application firewalls and intrusion detection systems
• Conduct regular security audits and penetration testing to ensure the plugin's security
• Review and update incident response plans to address potential exploitation of this vulnerability

Evidence notes

The vulnerability is caused by the public `mcs` GET parameter being reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs. This allows an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode, which can be used to invoke arbitrary loaded PHP functions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.