My Calendar plugin allows unauthenticated remote code execution via shortcode injection

The My Calendar – Accessible Event Manager plugin for WordPress contains a critical privilege escalation vulnerability that allows unauthenticated attackers to gain full administrative access. This flaw exists in all versions up to and including 3.8.7. The vulnerability is reachable through the plugin’s default public page, exposing sites that have activated the plugin without additional hardening.

Root cause

The issue stems from unsanitized handling of the public `mcs` GET parameter. This parameter is reflected into post content before WordPress core’s `do_shortcode` filter processes it. An attacker can inject a nested `[my_calendar above=...]` shortcode. The plugin’s `mc_generate_calendar_nav()` function then splits the `above` attribute on commas and dispatches each element via `call_user_func()`. This mechanism lacks authentication, authorization, or a callable allowlist check, enabling arbitrary PHP function invocation.

Attack path

Exploitation involves passing the shortcode `$params` array to the `edit_user()` function. PHP coerces this array to the integer `1`, which corresponds to the initial Administrator account’s user ID. This allows the attacker to overwrite the credentials of the primary administrator account. The attacker gains full access to the wp-admin interface. The entire process occurs without requiring any prior authentication or session tokens.

Affected versions

• All versions of the My Calendar – Accessible Event Manager plugin up to and including 3.8.7 are vulnerable.
• The vulnerability is present in the default configuration upon plugin activation.
• No safe versions are identified in the source material.

Mitigation

• Update the My Calendar plugin to a version newer than 3.8.7 once available.
• Restrict access to the `/my-calendar/` page if immediate updates are not possible.
• Monitor server logs for unauthorized administrative changes or credential updates.
• Verify that no unknown shortcodes are being processed by the plugin.

Signals worth monitoring

Teams usually review web server access logs for requests to the `/my-calendar/` endpoint containing unusual query parameters. Look for GET requests with the `mcs` parameter that include shortcode-like syntax. Check for unexpected calls to `call_user_func` in application logs or error traces. Monitor for sudden changes to user ID 1 credentials or password resets. Alert on any administrative login attempts from new IP addresses or user agents. Verify that shortcode processing does not involve dynamic function calls without strict allowlists. Review database audit logs for modifications to the users table, specifically targeting the administrator account.

Background: Privilege escalation attacks

Prevent privilege escalation by enforcing least privilege, auditing service accounts, and validating file permissions. Secure temporary directories, restrict kernel module loading, and monitor for unexpected process creations. Regularly review group memberships and disable unused administrative roles to close common attack vectors before they are exploited.

Read the full guide: Privilege Escalation Attack Prevention Checklist for Secure Systems

What to do and how to stay safe: My Calendar

• Check if your WordPress sites run the My Calendar plugin and identify the installed version.
• Monitor access logs for suspicious activity on the `/my-calendar/` page.
• Prepare to update the plugin immediately once a patched version is released.
• Review administrative account integrity for any unauthorized credential changes.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of the My Calendar plugin are affected by CVE-2026-104798?

All versions up to and including 3.8.7 are vulnerable to this privilege escalation flaw.

Can an attacker exploit this flaw without logging in?

Yes, the vulnerability allows unauthenticated attackers to gain full administrative access.

How does the attacker gain administrative privileges?

By invoking arbitrary PHP functions that overwrite the credentials of the initial Administrator account.