Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104798— My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

Quick assessment

Affected
joedolson My Calendar – Accessible Event Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"My Calendar – Accessible Event Manager"在所有 3.8.7 及更早版本中存在权限提升漏洞。该插件将未过滤的公共 GET 参数直接反射到帖子内容中，且此操作发生在 WordPress 核心的 过滤器执行之前。这使得未认证的攻击者能够注入嵌套的 短代码；随后， 函数会以逗号为分隔符拆分 属性，并通过 调用每个元素，且在此过程中未进行任何身份验证、授权或可调用函数白名单检查。 因此，未认证的攻击者可以调用任意已加载的 PHP 函数，构建一条调用链：将短代码的

CVSS 9.8 · Critical EPSS 0.89% · P59

Affected Version Matrix 5

VendorProduct Version RangeStatus
joedolson My Calendar – Accessible Event Manager ≤ 3.4.24 affected
3.5≤ 3.5.21 affected
3.6≤ 3.6.17 affected
3.7≤ 3.7.17 affected
3.8≤ 3.8.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104798

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
Source: CVE Program / CVE List V5
Vulnerability Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
joedolson My Calendar – Accessible Event Manager 0 ~ 3.4.24 -

II. Public POCs for CVE-2026-104798

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104798

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104798 (1)

Vendor Advisories for CVE-2026-104798 (1)

Vendor Pages for CVE-2026-104798 (1)

IV. Related Vulnerabilities

Same product: My Calendar – Accessible Event Manager
Same vendor: joedolson
Same weakness: CWE-269

V. Comments for CVE-2026-104798

No comments yet

Leave a comment