Executive brief
The My Calendar plugin for WordPress, used to manage and display events on websites, contains a security flaw that allows unauthorized individuals to view private calendar data. An attacker can access details of draft, deleted, or personal events that were intended to be hidden from the public. This could lead to the exposure of sensitive meeting titles, locations, descriptions, and organizer contact information.
Technical details
The My Calendar plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'vcal' parameter. This occurs due to insufficient validation of user-supplied keys when requesting iCalendar exports. An unauthenticated remote attacker can exploit this by enumerating occurrence IDs to retrieve iCalendar data for non-public events, including those in draft, trashed, or personal status. Successful exploitation results in the disclosure of sensitive metadata such as event titles, descriptions, dates, locations, and host details. The vulnerability is present in all versions up to and including 3.7.14.
Affected products
- Joe Dolson My Calendar – Accessible Event Manager up to, and including, 3.7.14
Timeline
- 2026-07-02: disclosed
- 2026-07-02: advisory
References
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/includes/date-utilities.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/includes/ical.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/my-calendar-api.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/my-calendar-api.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/my-calendar-events.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/my-calendar.php
- https://plugins.trac.wordpress.org/browser/my-calendar/trunk/includes/date-utilities.php