# CVE-2026-7525: Joe Dolson My Calendar authorization bypass in event editor

Source: https://junglewise.ai/threats/cve-2026-7525-joe-dolson-my-calendar-authorization-bypass-in-event-editor  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-7525 · Severity: medium · CVSS 4.3 · Published 2026-05-14

The My Calendar plugin for WordPress, which manages event schedules and displays, contains a security flaw that allows users with limited access to bypass the standard approval process. By manipulating web requests, these users can publish events or change event statuses to private or cancelled without the required administrative permission. This undermines the moderation workflow and could lead to unauthorized content being published on the organization's website.

Technologies: [Joe Dolson My Calendar](https://junglewise.ai/threats/technologies/my-calendar). Vendors: [Joe Dolson](https://junglewise.ai/threats/vendors/joe-dolson).

## Quick answers

**Is CVE-2026-7525 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7525 being exploited in the wild.

**How severe is CVE-2026-7525?** Medium severity, with a CVSS score of 4.3, published 14 May 2026.

**Which products and versions are affected?** Joe Dolson My Calendar up to, and including, 3.7.9.

**Is there a fix for CVE-2026-7525?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7525 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-7525?** Check whether you run Joe Dolson My Calendar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The My Calendar plugin for WordPress (up to version 3.7.9) is vulnerable to a missing authorization check (CWE-862) in the event editor component. While the user interface correctly hides administrative options from low-privilege users, the server-side code fails to validate the 'event_approved' parameter in POST requests against the user's actual capabilities. An authenticated attacker with at least custom-level access can bypass the moderation workflow by manually injecting or modifying the 'event_approved' status in the POST body. This allows them to publish events or set unauthorized statuses such as 'cancelled' or 'private'. The issue was addressed by removing legacy code that prioritized the POST parameter over server-side capability checks.

## Affected products

- Joe Dolson My Calendar – Accessible Event Manager up to, and including, 3.7.9

## Timeline

- 2026-05-14: advisory: NVD publication date
- 2026-05-14: disclosed: Wordfence vulnerability report published

## References

- [https://github.com/joedolson/my-calendar/commit/98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4](https://github.com/joedolson/my-calendar/commit/98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4)
- [https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php](https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php)
- [https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php](https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php)
- [https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php](https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php)
- [https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php](https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php)
- [https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php](https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php)
- [https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php](https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php)

## Related threats

- [My Calendar WordPress plugin shortcode injection](https://junglewise.ai/threats/cve-2026-119714-my-calendar-wordpress-plugin-3-8-8-before-3-8-11-contains-a)
- [Joe Dolson My Calendar SQL injection in mc_auth parameter](https://junglewise.ai/threats/cve-2026-6854-joe-dolson-my-calendar-sql-injection-in-mc-auth-parameter)
- [Joe Dolson My Calendar IDOR in vcal parameter](https://junglewise.ai/threats/cve-2026-11896-joe-dolson-my-calendar-idor-in-vcal-parameter)
- [joedolson My Calendar IDOR and DoS in mcjs_action AJAX endpoint](https://junglewise.ai/threats/cve-2026-40308-joedolson-my-calendar-idor-and-dos-in-mcjs-action-ajax-endpoint)