WordPress My Calendar Pre-Auth SQL Injection via mc_auth/mc_host (CVE-2026-6854)

Vulnerability Overview Vulnerability Name: My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters CVE ID: CVE-2026-6854 CVSS Score: 7.5 (High) Published Date: July 7, 2026 Last Updated: July 8, 2026 Researcher: Leonid Semenenko (leimenenko) Affected Software Software Type: Plugin Software Name: My Calendar – Accessible Event Manager Software Versions: <= 3.7.8 Affected Versions: <= 3.7.8 Remediation Fixed Version: 3.7.9 Remediation Advice: Upgrade to version 3.7.9 or later Vulnerability Description The My Calendar – Accessible Event Manager plugin contains a time-based blind SQL injection vulnerability in the parameter across all versions, including 3.7.8. Due to insufficient sanitization and preparation of user-supplied parameters, as well as inadequate preparation of existing SQL queries, unauthenticated attackers can append additional SQL queries to existing database queries, thereby extracting sensitive information. References plugins.trac.wordpress.org Additional Information Share Options: Facebook, Twitter, LinkedIn, Email Recent Vulnerabilities My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthorized Sensitive Information Disclosure via 'vcal' Parameter - CVE ID: CVE-2026-11896 - CVSS Score: 5.3 - Researchers: Athiwat Tipparatam (Jittado), Tharadit Saksaman (d3c4rt1) - Published Date: July 1, 2026 My Calendar <= 3.7.9 - Authenticated (Customer) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter - CVE ID: CVE-2026-7525 - CVSS Score: 4.3 - Researcher: typeSafe - Published Date: May 13, 2026 My Calendar – Accessible Event Manager <= 3.7.3 - Authenticated (Contributor) Stored Cross-Site Scripting via Shortcode Attributes - CVE ID: CVE-2026-2355 - CVSS Score: 6.4 - Researcher: Muhammad Yudha - DJ - Published Date: March 3, 2026 My Calendar <= 3.6.16 - Missing Authorization - CVE ID: CVE-2025-67592 - CVSS Score: 4.3 - Researcher: Doan Dinh Van (d52v) - Published Date: December 15, 2025 My Calendar <= 3.4.23 - Authenticated (Admin) Stored Cross-Site Scripting via Events - CVE ID: CVE-2024-1274 - CVSS Score: 4.4 - Researcher: cyc707 - Published Date: February 11, 2024 My Calendar <= 3.4.23 - Authenticated (Contributor) Stored Cross-Site Scripting via Shortcode - CVE ID: CVE-2024-25916 - CVSS Score: 6.4 - Researcher: Steven Julian - Published Date: February 11, 2024 My Calendar <= 3.4.21 - Unauthenticated SQL Injection - CVE ID: CVE-2023-6360 - CVSS Score: 9.8 - Researcher: Tenable - Published Date: November 26, 2023 My Calendar <= 3.4.3 - Cross-Site Request Forgery - CVE ID: CVE-2023-23813 - CVSS Score: 8.8 - Researcher: thiennv - Published Date: January 20, 2023 My Calendar <= 3.3.24.1 - Cross-Site Request Forgery - CVE ID: CVE-2022-47427 - CVSS Score: 7.1 - Researcher: rezaduty - Published Date: January 3, 2023 My Calendar <= 3.3.16 - Open Redirect - CVE ID: CVE-2022-36371 - CVSS Score: 4.7 - Researcher: Dan Kegel - Published Date: August 2, 2022 More Information View more vulnerabilities in this package: View Copyright Notice Copyright Information: 2012-2026 Defiant Inc. License: You are granted a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license by Defiant to copy, prepare derivative works, publicly display, publicly perform, sublicense, and distribute this vulnerability intelligence. Any copies made for this purpose are authorized, provided that they include the MITRE copyright notice and this license. Contact Information Contact Email: info-support@wordfence.com Additional Services Wordfence Intelligence: Offers free personal and commercial API access, as well as free webhook integration, to keep you up to date with new and updated vulnerabilities in the database. Wordfence WordPress Plugin: Install the Wordfence plugin to receive immediate notifications about vulnerabilities affecting your site. Documentation: View the documentation to learn how to access and consume the vulnerability data API. Business Hours Working Hours: 9 am - 8 pm ET, 6 am - 5 pm PT, and 2 pm - 1 am UTC/GMT (excluding weekends and holidays) Response Time: 24-hour support, 365 days a year, with a 1-hour response time Legal Terms Terms of Service: View Privacy Policy and Collection Notice: View Do Not Sell or Share My Personal Information: View Social Media Facebook: View Twitter: View LinkedIn: View Instagram: View Products and Support Wordfence Free: View Wordfence Premium: View Wordfence Care: View Wordfence Response: View Wordfence CLI: View Wordfence Intelligence: View Wordfence Central: View Support Documentation: View Learning Center: View Free Support: View Advanced Support: View News Blog: View News: View Advisories: View About About Wordfence: View Affiliate Program: View Careers: View Contact: View Security: View CVE Request Form: View Subscribe to Updates Subscribe: View Copyright Copyright: © 2012-2026 Defiant Inc. All rights reserved Other Cherubic: View

Goal Reached Thanks to every supporter — we hit 100%!

WordPress My Calendar Pre-Auth SQL Injection via mc_auth/mc_host (CVE-2026-6854)