p PatchFirst

PatchFirst · Latest vulnerabilities

joedolson/my-calendar vulnerabilities

Vulnerabilities published for joedolson/my-calendar in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-40308

    High · CVSS 8.8EPSS 0.93%Public exploitFix available

    My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

    My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and cr

    joedolson/my-calendarPHP
    • Update to 3.7.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →