CVE-2026-104798: CWE-269 Improper Privilege Management in joedolson My Calendar – Accessible Event Manager

CVE-2026-104798 describes a privilege escalation vulnerability in the My Calendar – Accessible Event Manager WordPress plugin (versions up to 3.8.7). The flaw arises because the public 'mcs' GET parameter is unsanitized and reflected into post content before WordPress processes shortcodes. Attackers can inject a nested '[my_calendar above=...]' shortcode, where the 'above' attribute is split and each element is dispatched via call_user_func() without authentication or authorization checks. This enables unauthenticated invocation of arbitrary PHP functions, including a call chain to edit_user() with coerced user ID 1, effectively overwriting the administrator credentials and granting full wp-admin access. The attack surface includes the plugin's default publicly accessible '/my-calendar/' page.

Successful exploitation results in full administrative control over the WordPress site by overwriting the administrator account credentials. This compromises confidentiality, integrity, and availability of the affected site. The vulnerability requires no authentication and has a low attack complexity, making it highly critical.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting access to the '/my-calendar/' page or the plugin itself to prevent exploitation.