Executive brief
The My Calendar plugin for WordPress, which is used to manage and display events on websites, contains a security flaw that allows unauthorized individuals to access private database information. By sending specially crafted requests, an attacker can bypass security measures to extract sensitive data such as user credentials or site configuration details. This could lead to a significant data breach or provide a foothold for further attacks on the website.
Technical details
A time-based blind SQL injection vulnerability exists in the My Calendar plugin due to insufficient escaping of the 'mc_auth' parameter and a lack of proper SQL query preparation. An unauthenticated remote attacker can exploit this by sending crafted web requests that append malicious SQL commands to existing queries. Because the vulnerability is time-based, the attacker can infer data from the database based on the server's response time. This allows for the extraction of sensitive information from the WordPress database. The issue is addressed in versions following 3.7.8.
Affected products
- Joe Dolson My Calendar – Accessible Event Manager <= 3.7.8
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory