CVE-2026-40308 HIGH

CVE-2026-40308: My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog

Vendor Joedolson
Product my-calendar
Weakness CWE-639 · IDOR
Published April 16, 2026
Last update April 17, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.

Explanation of Vulnerability in Simple Terms

02Summary

My Calendar contains a vulnerability that allows an attacker to read or modify sensitive data without authentication. The flaw requires only network access and can be exploited remotely. Site administrators should update immediately to patch this issue affecting versions before 3.7.7.

What an attacker can do

03Attacker Capabilities

Read or modify sensitive data on the site without logging in.

Potential impact on your site

04Site Impact

Attackers can access or alter calendar data and potentially other site information without credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 16, 2026 CVE published
April 17, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-41098 Insecure Direct Object Reference in GPS BOLD Workplanner CVE-2025-5195 Authorization Bypass Through User-Controlled Key in GitLab CVE-2026-1881 Broadstreet <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure via get_sponsored_meta CVE-2026-45155 Nextcloud: Private circle can be added to another circle via API CVE-2025-12040 Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation