CVE-2026-11896 describes an authorization bypass vulnerability (CWE-639) in the My Calendar – Accessible Event Manager plugin for WordPress. All versions up to and including 3.7.14 are affected. The vulnerability arises from insufficient validation of the 'vcal' parameter, which is user-controlled. This flaw enables unauthenticated attackers to enumerate occurrence IDs and retrieve full iCalendar exports of sensitive calendar events that should not be publicly accessible, including drafts and trashed events. The disclosed data includes sensitive event metadata such as titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An unauthenticated attacker can bypass authorization controls to access sensitive calendar event information that is intended to be private or restricted. This includes non-public, draft, trashed, and personal events, exposing metadata such as event titles, descriptions, dates, locations, organizer and host details, and permalinks. The confidentiality of event data is compromised, but integrity and availability are not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, consider restricting access to the affected plugin functionality or disabling the plugin if feasible to prevent unauthorized access. Monitor vendor channels for updates and apply official fixes once released.