A critical (CVSS 9.8) flaw in the My Calendar – Accessible Event Manager plugin for WordPress lets unauthenticated attackers run arbitrary loaded PHP functions and overwrite the credentials of the site's initial Administrator account.
What Is It
CVE-2026-104798 is a privilege escalation vulnerability (CWE-269) in the My Calendar – Accessible Event Manager plugin by joedolson. The public mcs GET parameter is reflected into post content without sanitization before WordPress core's do_shortcode filter runs. This lets an attacker inject a nested [my_calendar above=...] shortcode.
The plugin's mc_generate_calendar_nav() function then splits the above attribute on commas and passes each element to call_user_func(). It does no authentication, authorization or allowlist check on these calls, so an attacker can call any loaded PHP function. The disclosed attack chain passes the shortcode $params array to edit_user(), where PHP coerces it to integer 1 as the $user_id argument. This overwrites the credentials of the initial Administrator account (user ID 1).
Why It Matters
- No authentication needed: the CVSS vector is
AV:N/AC:L/PR:N/UI:N, so the attack works over the network with low complexity, no privileges and no user interaction. - Full site takeover: a successful attack gives the attacker full wp-admin access, with high impact to confidentiality, integrity and availability.
- Exposed by default: the plugin creates a
/my-calendar/page when it is activated, and that page is public by default. Wordfence describes exploitation through this page as "trivially reachable."
Exploitation status: No CISA KEV entry was provided for this CVE, so CISA has not confirmed active exploitation. The NVD record was published 2026-10-16 with status "Received."
What's Vulnerable
My Calendar – Accessible Event Manager (vendor: joedolson). The NVD description says all versions up to and including 3.8.7 are affected. The record lists these affected ranges:
- 0 through 3.4.24
- 3.5 through 3.5.21
- 3.6 through 3.6.17
- 3.7 through 3.7.17
- 3.8 through 3.8.7
Patch Status
The supplied data does not name a fixed release. The NVD references include a WordPress plugin Trac changeset for my-calendar, which suggests the code has changed upstream. Administrators should:
- Update to a release newer than the affected range for their branch, after checking it against the vendor changelog or the Wordfence advisory.
- Deactivate the plugin or restrict access to the
/my-calendar/page until they confirm a patched version is installed. - Check the user ID 1 account for unexpected credential changes.
No CISA required action applies, because the CVE has no KEV listing.