PT-2026-40850 · WordPress · My Calendar – Accessible Event Manager

CVE-2026-7525 · Published 2026-05-14 · Updated 2026-05-14

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions My Calendar – Accessible Event Manager versions prior to 3.8.0

Description The plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with custom-level access and above can bypass the moderation and approval workflow by manipulating the POST body. This allows them to publish events or assign unauthorized statuses, such as cancelled or private, which their assigned role should not permit. Although the user interface restricts low-privilege users to a draft-only submission button, this control is only enforced client-side and can be bypassed by directly modifying the POST request.

Recommendations Update to a version later than 3.7.9.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-7525

Affected Products

My Calendar – Accessible Event Manager

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7525.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7525 · Security Note
• https://osv.dev/vulnerability/CVE-2026-7525 · Vendor Advisory
• https://github.com/joedolson/my-calendar/commit/98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4 · Note
• https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php#L406 · Note
• https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php#L2384 · Note
• https://t.me/CVEtracker/53734 · Telegram Post
• https://plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-event-editor.php#L2384 · Note
• https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php#L2384 · Note
• https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php#L601 · Note
• https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php#L601 · Note
• https://t.me/cveNotify/163397 · Telegram Post
• https://plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-event-editor.php#L406 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3527861%40my-calendar&new=3527861%40my-calendar&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php#L406 · Note