What the vulnerability does
01Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.
Explanation of Vulnerability in Simple Terms
02Summary
My Calendar versions 3.7.14 and earlier contain an information disclosure vulnerability. An unauthenticated attacker can read limited sensitive data over the network without user interaction. The vulnerability has a CVSS score of 5.3 (medium severity). Site administrators should update to a version newer than 3.7.14 when available.
What an attacker can do
03Attacker Capabilities
Read limited sensitive information from the site without authentication.
Potential impact on your site
04Site Impact
Sensitive data may be exposed to unauthenticated visitors; update when a patch is released.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 2, 2026
CVE published
