5.3
Medium
CVE-2026-11896 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all…
Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| My Calendar – Accessible Event Manager 3.7 | earliest → 3.7.14 | No fix stated |
Other CVEs of My Calendar – Accessible Event Manager
The 7 CVEs of My Calendar – Accessible Event Manager →
CVE-2026-104798
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up…
9.8
Critical
CVE-2026-77187
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
6.4
Medium
CVE-2026-77186
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
6.4
Medium
CVE-2026-6854
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via…
7.5
High