CVE-2026-24523: WP FullCalendar Info Disclosure Flaw

CVE-2026-24523 Overview

CVE-2026-24523 is a Sensitive Data Exposure vulnerability affecting the WP FullCalendar WordPress plugin developed by Marcus (@msykes). This vulnerability allows unauthenticated attackers to retrieve embedded sensitive data from WordPress installations running vulnerable versions of the plugin. The flaw is classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

Critical Impact

Unauthenticated remote attackers can access sensitive system information without any user interaction, potentially exposing private data stored within the calendar system.

Affected Products

• WP FullCalendar plugin versions through 1.6
• WordPress installations using vulnerable WP FullCalendar versions
• Any website utilizing the wp-fullcalendar plugin without proper access controls

Discovery Timeline

• 2026-01-23 - CVE CVE-2026-24523 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-24523

Vulnerability Analysis

This vulnerability represents an information exposure flaw within the WP FullCalendar WordPress plugin. The plugin fails to properly restrict access to sensitive system information, allowing unauthorized actors to retrieve embedded data that should be protected. The network-accessible nature of this vulnerability means attackers can exploit it remotely without requiring any privileges or user interaction, making it particularly dangerous for publicly accessible WordPress sites.

The vulnerability allows attackers to extract sensitive data that may include calendar event details, user information, or other system data that the plugin has access to within the WordPress environment.

Root Cause

The root cause of CVE-2026-24523 lies in improper access control implementation within the WP FullCalendar plugin. The plugin exposes sensitive system information to an unauthorized control sphere, indicating that data retrieval endpoints or AJAX handlers lack proper authentication and authorization checks. This allows unauthenticated users to access data that should be restricted to authorized users or administrators only.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication, no user interaction, and presenting low complexity for exploitation. An attacker can remotely target vulnerable WordPress installations by sending specially crafted requests to the WP FullCalendar plugin endpoints. The vulnerability specifically enables the retrieval of embedded sensitive data, which could include:

• Private calendar event information
• User-specific data associated with calendar entries
• System configuration details exposed through the plugin

The attack does not require the attacker to be authenticated to the WordPress site, making any publicly accessible WordPress installation running the vulnerable plugin a potential target.

Detection Methods for CVE-2026-24523

Indicators of Compromise

• Unusual access patterns to WP FullCalendar AJAX endpoints or API routes
• Unexpected requests to calendar-related WordPress endpoints from external IP addresses
• Abnormal volume of requests targeting wp-fullcalendar plugin resources
• Log entries showing unauthenticated access to calendar data retrieval functions

Detection Strategies

• Monitor WordPress access logs for suspicious requests targeting /wp-content/plugins/wp-fullcalendar/ paths
• Implement Web Application Firewall (WAF) rules to detect and block unauthorized data retrieval attempts
• Review WordPress audit logs for anomalous calendar data access patterns
• Deploy endpoint detection solutions to identify exploitation attempts against WordPress installations

Monitoring Recommendations

• Enable detailed logging for all WordPress plugin activities
• Configure alerts for high-volume requests to calendar-related endpoints
• Implement rate limiting on AJAX handlers used by the WP FullCalendar plugin
• Regularly audit access logs for signs of data exfiltration attempts

How to Mitigate CVE-2026-24523

Immediate Actions Required

• Immediately update WP FullCalendar to a patched version when available from the vendor
• Consider temporarily deactivating the WP FullCalendar plugin until a security patch is released
• Review WordPress access logs for any signs of prior exploitation
• Implement additional access controls at the web server level to restrict plugin endpoint access

Patch Information

As of the last update on 2026-01-26, affected users should monitor the Patchstack Vulnerability Report for official patch information from the plugin developer. Users running WP FullCalendar version 1.6 or earlier should consider this plugin vulnerable and take appropriate protective measures.

Workarounds

• Restrict access to the WP FullCalendar plugin endpoints using .htaccess rules or web server configuration
• Implement IP-based access restrictions for sensitive calendar functionality
• Use a security plugin to add additional authentication layers to vulnerable endpoints
• Consider using an alternative calendar plugin until a patched version is available

# Apache .htaccess configuration to restrict plugin access
<Directory "/var/www/html/wp-content/plugins/wp-fullcalendar">
    # Restrict direct access to plugin files
    Order Deny,Allow
    Deny from all
    # Allow only from trusted IP addresses
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>