Is CVE-2026-7525 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7525 being exploited in the wild.

How severe is CVE-2026-7525?

Medium severity, with a CVSS score of 4.3, published 14 May 2026.

Which products and versions are affected?

Joe Dolson My Calendar up to, and including, 3.7.9.

Is there a fix for CVE-2026-7525?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-7525 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-7525?

Check whether you run Joe Dolson My Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7525: Joe Dolson My Calendar authorization bypass in event editor

CVE-2026-7525 · Severity: medium · CVSS 4.3 · Published 2026-05-14

The My Calendar plugin for WordPress, which manages event schedules and displays, contains a security flaw that allows users with limited access to bypass the standard approval process. By manipulating web requests, these users can publish events or change event statuses to private or cancelled without the required administrative permission. This undermines the moderation workflow and could lead to unauthorized content being published on the organization's website.

Technologies: Joe Dolson My Calendar. Vendors: Joe Dolson.

Quick answers

Is CVE-2026-7525 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7525 being exploited in the wild.
How severe is CVE-2026-7525?: Medium severity, with a CVSS score of 4.3, published 14 May 2026.
Which products and versions are affected?: Joe Dolson My Calendar up to, and including, 3.7.9.
Is there a fix for CVE-2026-7525?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7525 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-7525?: Check whether you run Joe Dolson My Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The My Calendar plugin for WordPress (up to version 3.7.9) is vulnerable to a missing authorization check (CWE-862) in the event editor component. While the user interface correctly hides administrative options from low-privilege users, the server-side code fails to validate the 'event_approved' parameter in POST requests against the user's actual capabilities. An authenticated attacker with at least custom-level access can bypass the moderation workflow by manually injecting or modifying the 'event_approved' status in the POST body. This allows them to publish events or set unauthorized statuses such as 'cancelled' or 'private'. The issue was addressed by removing legacy code that prioritized the POST parameter over server-side capability checks.

Affected products

Joe Dolson My Calendar – Accessible Event Manager up to, and including, 3.7.9

Timeline

2026-05-14: advisory: NVD publication date
2026-05-14: disclosed: Wordfence vulnerability report published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.