CVE-2026-40308: My Calendar WordPress Plugin DoS Vulnerability

CVE-2026-40308 Overview

CVE-2026-40308 is an Authorization Bypass vulnerability affecting the My Calendar WordPress plugin, a popular tool for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, which is registered for unauthenticated users, passes user-supplied arguments through parse_str() without proper validation. This allows injection of arbitrary parameters including a site value, enabling attackers to bypass intended access controls.

On WordPress Multisite installations, this vulnerability enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, the switch_to_blog() function does not exist, causing an uncaught PHP fatal error that crashes the worker thread, creating an unauthenticated denial of service vector.

Critical Impact

Unauthenticated attackers can extract private calendar data across WordPress Multisite networks or crash Single Site installations through a denial of service attack.

Affected Products

• My Calendar WordPress Plugin versions 3.7.6 and below
• WordPress Multisite installations using My Calendar (Information Disclosure)
• WordPress Single Site installations using My Calendar (Denial of Service)

Discovery Timeline

• 2026-04-16 - CVE CVE-2026-40308 published to NVD
• 2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-40308

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to properly validate user-controlled input that determines which resources a user can access. The mc_ajax_mcjs_action AJAX endpoint is accessible to unauthenticated users and processes parameters using PHP's parse_str() function without adequate validation.

The lack of input sanitization allows attackers to inject arbitrary parameters into the function call, including a site parameter that controls which WordPress site's data is accessed. This represents a fundamental authorization flaw where user input directly controls access to protected resources across the multisite network.

Root Cause

The root cause of this vulnerability lies in the unsafe use of parse_str() to process user-supplied input without validation or sanitization. The parse_str() function in PHP parses a query string into variables, and when used with untrusted input, it allows attackers to override or inject arbitrary variables. The endpoint fails to implement proper authorization checks before allowing the site parameter to influence the switch_to_blog() function call, enabling cross-site data access on Multisite installations. On Single Site installations, the absence of the switch_to_blog() function causes a fatal PHP error when the injected parameter attempts to call it.

Attack Vector

The attack is conducted over the network without requiring any authentication or user interaction. An attacker can craft malicious AJAX requests to the mc_ajax_mcjs_action endpoint with injected parameters.

For WordPress Multisite installations, the attacker injects a site parameter with target site IDs to enumerate and extract calendar events from any sub-site, including private calendars that should be inaccessible. By iterating through site IDs, an attacker can systematically harvest calendar data across the entire network.

For WordPress Single Site installations, the attack triggers a PHP fatal error by attempting to call the non-existent switch_to_blog() function, causing the PHP worker thread to crash. Repeated requests can effectively deny service to legitimate users.

Detection Methods for CVE-2026-40308

Indicators of Compromise

• Unusual AJAX requests to the mc_ajax_mcjs_action endpoint from unauthenticated sources
• Web server logs showing repeated requests with suspicious site parameter values
• PHP fatal error logs indicating calls to undefined function switch_to_blog() on Single Site installations
• Unexpected access patterns to calendar event data across multiple sub-sites

Detection Strategies

• Monitor WordPress AJAX endpoints for anomalous request patterns from unauthenticated users
• Implement Web Application Firewall (WAF) rules to detect and block requests with injected site parameters
• Review PHP error logs for fatal errors related to switch_to_blog() function calls
• Audit access logs for enumeration attempts targeting the My Calendar AJAX endpoints

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and monitor for suspicious parameter injection
• Set up alerts for PHP fatal errors on Single Site installations that may indicate active exploitation
• Monitor for unusual data access patterns across WordPress Multisite sub-sites
• Implement rate limiting on AJAX endpoints to mitigate denial of service attempts

How to Mitigate CVE-2026-40308

Immediate Actions Required

• Update My Calendar plugin to version 3.7.7 or later immediately
• Review access logs for signs of exploitation attempts targeting the vulnerable endpoint
• On Multisite installations, audit calendar event access for unauthorized data exposure
• Consider temporarily disabling the My Calendar plugin if immediate update is not possible

Patch Information

The vulnerability has been fixed in My Calendar version 3.7.7. The patch addresses the unsafe use of parse_str() by implementing proper input validation and authorization checks on the mc_ajax_mcjs_action AJAX endpoint. Users should update immediately through the WordPress plugin updater or by downloading the patched version from the GitHub Release v3.7.7. For complete technical details, refer to the GitHub Security Advisory GHSA-2mvx-f5qm-v2ch.

Workarounds

• Restrict access to WordPress AJAX endpoints using web server configuration or WAF rules
• Implement IP-based access controls to limit exposure of the vulnerable endpoint
• On Multisite installations, consider network-level segmentation to limit cross-site access
• Monitor and rate-limit requests to AJAX endpoints to mitigate denial of service impact

# Example: Block unauthenticated access to the vulnerable AJAX action via .htaccess
# Add to WordPress .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} action=mc_ajax_mcjs_action [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>