CVE-2026-104798: My Calendar WordPress Privilege Escalation

CVE-2026-104798 Overview

CVE-2026-104798 is a critical privilege escalation vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress, affecting all versions up to and including 3.8.7. The flaw lets unauthenticated attackers overwrite the credentials of the initial Administrator account (user ID 1) through the plugin's public /my-calendar/ page. The vulnerability is categorized under [CWE-269] Improper Privilege Management and stems from unsanitized reflection of a GET parameter into shortcode content processed by WordPress core.

Critical Impact
Remote, unauthenticated attackers can take over the primary WordPress Administrator account and gain full wp-admin access with no user interaction.

Affected Products

My Calendar – Accessible Event Manager plugin for WordPress, versions up to and including 3.8.7
WordPress sites with the plugin activated and the auto-generated /my-calendar/ page publicly reachable
Any site exposing the vulnerable mcs GET parameter handler

Discovery Timeline

2026-10-16 - CVE-2026-104798 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104798

Vulnerability Analysis

The vulnerability chains three distinct weaknesses in the My Calendar plugin to achieve unauthenticated account takeover. The public mcs GET parameter is reflected into post content without sanitization before WordPress core's do_shortcode filter executes. This allows an attacker to inject a nested [my_calendar above=...] shortcode through the URL.

Once the nested shortcode is parsed, mc_generate_calendar_nav() splits the above attribute on commas and dispatches each element through PHP's call_user_func(). The dispatcher performs no authentication check, no capability check, and no callable allowlist validation. Attackers can therefore invoke any PHP function loaded in the WordPress runtime, including privileged administrative helpers.

Root Cause

The root cause is a combination of improper input neutralization and missing access control around a dynamic function dispatcher. By passing user-controlled strings directly to call_user_func() without an allowlist, the plugin exposes the full set of loaded PHP callables to unauthenticated requests. The absence of a capability or nonce check on the shortcode handler compounds the issue.

Attack Vector

Exploitation requires only a crafted HTTP GET request to the plugin's auto-generated /my-calendar/ page, which is publicly accessible by default upon plugin activation. The attacker injects a nested [my_calendar above=edit_user,...] shortcode through the mcs parameter. When edit_user() is invoked, the shortcode $params array is passed as the first argument, and PHP coerces the array to the integer 1 as the $user_id value. This overwrites the credentials of the initial Administrator account (user ID 1), granting the attacker full wp-admin access.

The network-reachable, no-privilege, no-interaction exploitation profile makes this issue trivially weaponizable at scale against unpatched WordPress installations. See the Wordfence Vulnerability Report and the WordPress My Calendar Navigation Code for the vulnerable code paths.

Detection Methods for CVE-2026-104798

Indicators of Compromise

HTTP requests to /my-calendar/ containing an mcs query parameter with URL-encoded shortcode syntax such as [my_calendar or above=
Requests referencing sensitive callables including edit_user, wp_update_user, or wp_set_password inside the mcs parameter value
Unexpected password or email changes on the user with ID 1 shortly after suspicious /my-calendar/ traffic
New administrator sessions originating from previously unseen IP addresses following plugin-page requests

Detection Strategies

Inspect web server and WAF logs for GET requests to /my-calendar/ whose query strings contain %5B (encoded [) or the literal strings my_calendar and above=
Correlate WordPress user_meta and wp_users modifications with HTTP access logs to identify administrator credential changes without a corresponding authenticated session
Audit the WordPress wp-admin login log for sessions on user ID 1 that lack a preceding legitimate authentication event

Monitoring Recommendations

Alert on any write operation to the wp_users row where ID = 1, including user_pass, user_email, and user_login columns
Monitor plugin installations and versions across the estate to flag any My Calendar instance at version 3.8.7 or earlier
Track outbound requests from WordPress hosts after suspicious /my-calendar/ activity to identify follow-on webshell or payload fetches

How to Mitigate CVE-2026-104798

Immediate Actions Required

Update the My Calendar plugin to a version later than 3.8.7 as soon as the vendor releases a fixed build
Deactivate the My Calendar plugin on all WordPress sites that cannot be patched immediately
Rotate the password and application passwords for the primary Administrator account (user ID 1) and audit all accounts with the administrator role
Review recent HTTP access logs for requests matching the exploitation pattern described above

Patch Information

The vendor committed a fix referenced in the WordPress My Calendar Changeset. Site administrators should upgrade through the WordPress plugin manager or by replacing the plugin files with the patched release. Confirm the installed version is greater than 3.8.7 after update.

Workarounds

Block or filter HTTP requests to /my-calendar/ that contain the mcs parameter at the WAF or reverse proxy layer
Restrict access to the auto-generated /my-calendar/ page via server configuration or an access control plugin until patched
Remove or unpublish the auto-generated My Calendar page to break the public exploitation path

bash

# Example nginx rule to block exploitation patterns
if ($request_uri ~* "/my-calendar/.*[?&]mcs=.*(%5B|my_calendar|above=)") {
    return 403;
}