Security Alert Summary
The My Calendar WordPress plugin contains a vulnerability in an unauthenticated AJAX endpoint that allows user-supplied arguments to be passed through parse_str() without validation. On Multisite installations this can permit extraction of calendar events from other subsites by switching to an arbitrary blog ID. On single-site installs the same input can trigger an uncaught PHP fatal error and crash the worker thread, creating a denial of service vector. The issue is addressed in version 3.7.7.
CVE Details
- CVE ID: CVE-2026-40308
- Affected plugin or component: My Calendar (WordPress plugin for managing calendar events)
- Affected versions: versions 3.7.6 and below
- Published: April 16, 2026 at 10:16:38 PM UTC
- Last modified: April 17, 2026 at 3:38:09 PM UTC
- CVSS (version 4.0): Base Score 8.8, Severity HIGH
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- User Interaction: NONE
- Primary impact:
- Confidentiality: HIGH
- Integrity: NONE
- Availability: HIGH
- CWE / weakness ID: CWE-639
Technical Details
The plugin registers an unauthenticated AJAX endpoint named mc_ajax_mcjs_action that accepts user-supplied arguments. Those arguments are passed through parse_str() without validation, which allows injection of arbitrary parameters, including a parameter representing a site value. Because the input is not validated or sanitized before being used, an attacker can supply a site identifier that is later used with switch_to_blog() on WordPress Multisite installations.
On Multisite, an unauthenticated attacker can call switch_to_blog() with an arbitrary site ID and extract calendar events from any subsite on the network, potentially exposing private or hidden events. On Single Site installations, the switch_to_blog() function does not exist; supplying the same input causes an uncaught PHP fatal error that crashes the worker thread, creating an unauthenticated denial of service vector. The change that fixes this issue is included in version 3.7.7.
How This Could Impact Your Website
Consider a networked WordPress installation where the site owner, internal staff, and an external contractor all manage calendar entries on different subsites. An attacker exploiting this issue on a Multisite network could retrieve calendar entries from other subsites, including events intended to be private or hidden. That exposure could reveal meeting dates, locations, attendee names, or other sensitive scheduling details that increase the risk of targeted phishing or social engineering against staff or contractors.
On a standard single-site deployment the same malformed input can cause the PHP worker handling requests to crash, producing a denial of service condition that affects site availability until the worker is restored.
professional review: If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin to the patched release (version 3.7.7) as soon as possible.
- Review and reduce unnecessary user roles and capabilities across the network, especially for contributors and contractors.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your site and network.
- Monitor site and server activity for signs of unusual requests, repeated AJAX calls, or worker crashes that could indicate exploitation attempts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
