Executive brief
A vulnerability in the My Calendar plugin for WordPress allows unauthorized users to access private calendar events or crash the website. On multi-site networks, an attacker can view private event data from any sub-site. On single-site installations, the same flaw can be used to repeatedly crash the server, leading to a total service outage.
Technical details
The vulnerability exists in the `mc_ajax_mcjs_action` function, which handles the `mcjs_action` AJAX endpoint. The plugin unsafely uses PHP's `parse_str()` on the unvalidated `args` request parameter, allowing attackers to inject arbitrary key-value pairs. When the `site` argument is provided, the plugin calls `switch_to_blog()` without privilege checks. In WordPress Multisite environments, this allows an unauthenticated attacker to switch database contexts and extract private events from any sub-site. In Single Site environments, calling the non-existent `switch_to_blog()` function triggers an uncaught PHP error, allowing for an unauthenticated application-layer Denial of Service (DoS). This is patched in version 3.7.7.
Affected products
- joedolson My Calendar < 3.7.7
Timeline
- 2026-04-16: disclosed
- 2026-04-16: advisory
- 2026-04-16: patched: Fixed in version 3.7.7