{"id":"CVE-2026-104798","kind":"vulnerability","aliases":["CVE-2026-104798"],"related":[],"title":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all…","description":"The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.","summary":"The My Calendar WordPress plugin up to and including 3.8.7 lets an unauthenticated visitor inject a shortcode through the public mcs GET parameter and reach arbitrary PHP functions. The described chain overwrites the credentials of user ID 1, the initial Administrator, so the attacker gets full wp-admin access.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["my-calendar","package","self-hosted","wordpress"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"Check the installed My Calendar plugin version under wp-admin > Plugins; versions 3.8.7 and below are affected.","fix":"Update the My Calendar – Accessible Event Manager plugin to a version newer than 3.8.7; the fixed version is not stated in the sources.\nIf you cannot update immediately, deactivate the plugin and rotate the administrator password.","status":"open","published_at":"2026-10-16T05:17:28+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:05:13+00:00","updated_at":"2026-10-23T22:28:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:05:13Z","model":"claude-haiku-5-5","output":{"fix":"Update the My Calendar – Accessible Event Manager plugin to a version newer than 3.8.7; the fixed version is not stated in the sources.\nIf you cannot update immediately, deactivate the plugin and rotate the administrator password.","reach":"internet","impact":"high","summary":"The My Calendar WordPress plugin up to and including 3.8.7 lets an unauthenticated visitor inject a shortcode through the public mcs GET parameter and reach arbitrary PHP functions. The described chain overwrites the credentials of user ID 1, the initial Administrator, so the attacker gets full wp-admin access.","category":"package","who_cares":["wordpress","my-calendar","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker takes over the site's primary administrator account","analyst_note":"Confirm the fixed plugin version and whether a patch is available at the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-104798 or the WordPress plugin changelog.","how_to_check":"Check the installed My Calendar plugin version under wp-admin > Plugins; versions 3.8.7 and below are affected.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-deactivated"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000554,"input_tokens":3042,"output_tokens":500,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-104798':17A,20A '-2026':16A,19A '/my-calendar':229C '1':66B,192C,208C '3.8.7':38B,100C 'access':4A,78B,82C,217C,234C 'account':205C 'activ':239C 'admin':77B,216C 'administr':69B,204C 'allow':120C 'allowlist':157C 'arbitrari':54B,168C 'argument':197C 'array':181C 'attack':72B,123C,165C,212C 'attribut':140C 'authent':153C 'author':154C 'auto':227C 'auto-gener':226C 'calendar':3A,23B,31B,81C,129C,134C 'call':148C,174C 'callabl':156C 'chain':59B,175C 'check':158C 'coerc':189C 'comma':142C 'content':110C 'core':114C 'credenti':62B,200C 'cve':15A,18A 'default':236C 'describ':58B 'dispatch':144C 'edit':185C 'element':146C 'enabl':172C 'escal':14A,92C 'event':5A,83C 'exploit':218C 'filter':118C 'full':74B,213C 'func':150C 'function':56B,171C 'generat':133C,228C 'get':50B,73B,104C 'grant':210C 'host':27B 'id':65B,196C,207C 'includ':37B,99C 'initi':68B,203C 'inject':43B,125C 'integ':191C 'invok':167C 'let':39B 'load':169C 'make':160C 'manag':6A,84C 'mc':132C 'mcs':49B,103C 'my-calendar':21B 'nav':135C 'nest':127C 'overwrit':60B,198C 'packag':24B 'page':230C 'param':180C 'paramet':51B,105C 'pass':183C 'php':55B,170C,188C 'plugin':7A,33B,85C,224C,238C 'possibl':162C 'post':109C 'privileg':13A,91C 'public':48B,102C,233C 'reach':53B 'reachabl':221C 'reflect':107C 'run':119C 'self':26B 'self-host':25B 'shortcod':45B,117C,131C,179C 'split':137C 'trivial':220C 'unauthent':41B,122C,164C 'unsanit':111C 'upon':237C 'user':64B,149C,186C,195C,206C 'version':95C 'via':147C,222C 'visitor':42B 'vulner':11A,89C 'wordpress':9A,28B,32B,87C,113C 'wp':76B,215C 'wp-admin':75B,214C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104798","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104798","severity":null,"published_at":"2026-10-16T05:17:28+00:00","modified_at":"2026-10-16T18:17:20+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}