The My Calendar plugin for WordPress versions 3.7.6 and earlier exposes an unauthenticated AJAX endpoint (mc_ajax_mcjs_action) that uses parse_str() on user input without validation. This allows injection of arbitrary parameters, including a 'site' value. On WordPress Multisite setups, attackers can invoke switch_to_blog() with arbitrary site IDs to access calendar events from other sub-sites, including private or hidden events, constituting an authorization bypass. On single-site setups, the absence of switch_to_blog() causes a fatal PHP error, resulting in an unauthenticated denial of service. The vulnerability is tracked as CVE-2026-40308 with a CVSS 4.0 score of 8.8 (high severity). The issue is resolved in My Calendar version 3.7.7.

On WordPress Multisite installations, attackers can bypass authorization controls to access calendar events from any sub-site, including private or hidden events, potentially exposing sensitive information. On single-site installations, the vulnerability causes a PHP fatal error that crashes the worker thread, enabling an unauthenticated denial of service. There are no known exploits in the wild as of the published date.

Upgrade the My Calendar plugin to version 3.7.7 or later, where this vulnerability has been fixed. No other mitigations are specified. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 3.7.7, indicating an official fix is available.