CVE-2026-6854 describes a time-based blind SQL Injection vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress. The issue arises from improper neutralization of special elements in the 'mc_auth' parameter, which is used in SQL queries without sufficient escaping or prepared statements. This allows unauthenticated attackers to append malicious SQL code to existing queries, enabling extraction of sensitive data from the backend database. The vulnerability affects all versions up to and including 3.7.8. No official patch or remediation level has been provided as of the published date.

An unauthenticated attacker can exploit this vulnerability to perform time-based blind SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin. Monitoring for updates from the vendor or security advisories is recommended. No official patch or temporary fix has been documented at this time.