CVE-2026-7525 is an authorization bypass vulnerability (CWE-862) in the My Calendar – Accessible Event Manager plugin for WordPress versions up to 3.7.9. The plugin fails to properly verify user authorization server-side, allowing authenticated users with custom-level access or above to bypass moderation and approval workflows by manipulating POST request bodies. Although the UI restricts low-privilege users to submitting drafts only, this control is enforced client-side and can be trivially bypassed. The vulnerability enables unauthorized changes to event statuses such as publishing, cancelling, or setting events to private, which the user's role does not permit.

The vulnerability allows authenticated users with limited privileges to escalate their permissions to publish or modify events without proper authorization. This impacts the integrity of event data by enabling unauthorized status changes. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — no official fix or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates. Until a patch is released, administrators should restrict user roles carefully and consider additional server-side authorization checks or temporary workarounds to prevent unauthorized event status changes.