Description

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` — which PHP coerces to integer `1` as the `$user_id` argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-16T05:17:28.580Z",
  "pubdate": "2026-10-16T05:17:28.580Z",
  "executiveSummary": "The My Calendar – Accessible Event Manager plugin for WordPress is susceptible to a critical privilege escalation vulnerability in all versions up to and including 3.8.7.\nThe vulnerability stems from improper input validation and the execution of arbitrary PHP functions via shortcode attributes.\nAn unauthenticated attacker can exploit this flaw to manipulate user account credentials, specifically targeting administrative accounts.\nBy injecting a malicious shortcode through the 'mcs' GET parameter, an attacker can trigger a call chain that invokes the 'edit_user()' function.\nThis results in the unauthorized modification of the primary administrator account (User ID 1), granting the attacker full administrative access to the WordPress environment.\nGiven the plugin's default behavior of creating a public-facing '/my-calendar/' page upon activation, this vulnerability is highly accessible to remote, unauthenticated attackers.\nThe risk implication is absolute, as successful exploitation facilitates total site compromise, including the ability to execute arbitrary code, modify content, and exfiltrate sensitive data.",
  "technicalDetails": "The vulnerability originates in the My Calendar plugin's handling of the 'mcs' GET parameter. The plugin reflects this parameter directly into the post content without adequate sanitization before the execution of the WordPress 'do_shortcode' filter.\nThe core flaw lies within 'mc_generate_calendar_nav()', which processes the 'above' attribute of the 'my_calendar' shortcode. The function parses the attribute value by splitting it on commas and subsequently passes these elements as arguments into 'call_user_func()'.\nCrucially, there is a total lack of authentication, authorization, or a restrictive allowlist for the functions being invoked via 'call_user_func()'. This architectural oversight allows an attacker to execute any loaded PHP function by crafting a specific shortcode payload.\nThe primary exploitation vector involves injecting a nested shortcode structure within the 'mcs' parameter. An attacker can leverage this primitive to pass a user-controlled parameter array to the 'edit_user()' function. Because the function signature is manipulated via the malicious shortcode, the $user_id argument is coerced by PHP to the integer '1'.\nWhen 'edit_user()' is invoked with the attacker-controlled payload, the system overwrites the credentials of the WordPress administrator (User ID 1). This bypasses traditional authentication mechanisms entirely, as the account state is modified programmatically during the request lifecycle.\nThe attack flow is as follows: 1) An unauthenticated attacker identifies the public '/my-calendar/' page. 2) The attacker submits a specially crafted request containing an 'mcs' parameter with a malicious nested 'my_calendar' shortcode. 3) The application reflects this input into the document structure. 4) 'do_shortcode' triggers the 'mc_generate_calendar_nav()' function. 5) The application executes 'call_user_func()' with the malicious arguments. 6) 'edit_user()' is called, reconfiguring the credentials for the administrator account. 7) The attacker authenticates as the administrator using the injected credentials, achieving full administrative control over the target WordPress instance."
}