/Vulnerability Library

My Calendar WordPress Plugin - Information Disclosure

CVE-2026-40308
Verified

Description

My Calendar WordPress plugin <= 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parse_str() in mc_ajax_mcjs_action endpoint, letting unauthenticated attackers access or crash sites via switch_to_blog(), exploit requires WordPress Multisite or Single Site setup.

Severity

High

Exploit Probability

1%

Affected Product

my-calendar

Published Date

April 22, 2026

Template Author

theamanrawat

CVE-2026-40308.yaml
7.5Severity

CVSS Metrics

CVE ID:
cve-2026-40308
CWE ID:
cwe-639

References

https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2chhttps://nvd.nist.gov/vuln/detail/CVE-2026-40308

Remediation Steps

Update to version 3.7.7 or later.