Executive brief
The My Calendar plugin for WordPress, which manages event schedules and displays, contains a security flaw that allows users with limited access to bypass the standard approval process. By manipulating web requests, these users can publish events or change event statuses to private or cancelled without the required administrative permission. This undermines the moderation workflow and could lead to unauthorized content being published on the organization's website.
Technical details
The My Calendar plugin for WordPress (up to version 3.7.9) is vulnerable to a missing authorization check (CWE-862) in the event editor component. While the user interface correctly hides administrative options from low-privilege users, the server-side code fails to validate the 'event_approved' parameter in POST requests against the user's actual capabilities. An authenticated attacker with at least custom-level access can bypass the moderation workflow by manually injecting or modifying the 'event_approved' status in the POST body. This allows them to publish events or set unauthorized statuses such as 'cancelled' or 'private'. The issue was addressed by removing legacy code that prioritized the POST parameter over server-side capability checks.
Affected products
- Joe Dolson My Calendar – Accessible Event Manager up to, and including, 3.7.9
Timeline
- 2026-05-14: advisory: NVD publication date
- 2026-05-14: disclosed: Wordfence vulnerability report published
References
- https://github.com/joedolson/my-calendar/commit/98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php
- https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php