PT-2026-33370 · WordPress · My Calendar

Published 2026-04-16 · Updated 2026-04-22 · CVE-2026-40308

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions My Calendar versions prior to 3.7.7

Description An unauthenticated issue exists in the 'mc ajax mcjs action' AJAX endpoint, which is registered for unauthenticated users. The endpoint passes user-supplied arguments through the parse str() function without proper validation, allowing the injection of arbitrary parameters, including a site value. This is processed by the my calendar upcoming events() function.

On WordPress Multisite installations, this allows an unauthenticated attacker to use the switch to blog() function with an arbitrary site ID to extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, the switch to blog() function does not exist, which triggers an uncaught PHP fatal error and crashes the worker thread, resulting in a denial of service.

Recommendations Update to version 3.7.7.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-40308

GHSA-2MVX-F5QM-V2CH

Affected Products

My Calendar

References · 7

• 🔥 https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch · Exploit
• https://osv.dev/vulnerability/GHSA-2mvx-f5qm-v2ch · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40308 · Security Note
• https://github.com/joedolson/my-calendar · Note
• https://github.com/joedolson/my-calendar/releases/tag/v3.7.7 · Note
• https://twitter.com/pdnuclei_bot/status/2046952196324147251 · Twitter Post
• https://twitter.com/CVEnew/status/2045102645094871453 · Twitter Post