Vulnerabilities

Vulnerability · CVE-2026-104798

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.

Published Oct 16, 2026 · catalog updated Oct 16, 2026 · The My Calendar –

Check if you run it

No confirmed exploitation is on record for CVE-2026-104798. EPSS is 0.89%. Act only if a listed version of The My Calendar – is installed.

Severity

Critical9.8

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.89%

Remediation

Not established

Affected products

See sources for product scope

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public GET parameter is reflected into post content unsanitized before WordPress core's filter runs, allowing an unauthenticated attacker to inject a nested shortcode; then splits the attribute on commas and dispatches each element via with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode array is passed to — which PHP coerces to integer as the argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated page, which is publicly accessible by default upon plugin activation.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.