CVE-2026-40308: My Calendar WordPress Plugin DoS Vulnerability

CVE-2026-40308 Overview

CVE-2026-40308 is an Authorization Bypass vulnerability affecting the My Calendar WordPress plugin, a popular tool for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, which is registered for unauthenticated users, passes user-supplied arguments through parse_str() without proper validation. This allows injection of arbitrary parameters including a site value, enabling attackers to bypass intended access controls.

On WordPress Multisite installations, this vulnerability enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, the switch_to_blog() function does not exist, causing an uncaught PHP fatal error that crashes the worker thread, creating an unauthenticated denial of service vector.

Critical Impact
Unauthenticated attackers can extract private calendar data across WordPress Multisite networks or crash Single Site installations through a denial of service attack.

Affected Products

My Calendar WordPress Plugin versions 3.7.6 and below
WordPress Multisite installations using My Calendar (Information Disclosure)
WordPress Single Site installations using My Calendar (Denial of Service)

Discovery Timeline

2026-04-16 - CVE CVE-2026-40308 published to NVD
2026-04-16 - Last updated in NVD database

Technical Details for CVE-2026-40308

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to properly validate user-controlled input that determines which resources a user can access. The mc_ajax_mcjs_action AJAX endpoint is accessible to unauthenticated users and processes parameters using PHP's parse_str() function without adequate validation.

The lack of input sanitization allows attackers to inject arbitrary parameters into the function call, including a site parameter that controls which WordPress site's data is accessed. This represents a fundamental authorization flaw where user input directly controls access to protected resources across the multisite network.

Root Cause

The root cause of this vulnerability lies in the unsafe use of parse_str() to process user-supplied input without validation or sanitization. The parse_str() function in PHP parses a query string into variables, and when used with untrusted input, it allows attackers to override or inject arbitrary variables. The endpoint fails to implement proper authorization checks before allowing the site parameter to influence the switch_to_blog() function call, enabling cross-site data access on Multisite installations. On Single Site installations, the absence of the switch_to_blog() function causes a fatal PHP error when the injected parameter attempts to call it.

Attack Vector

The attack is conducted over the network without requiring any authentication or user interaction. An attacker can craft malicious AJAX requests to the mc_ajax_mcjs_action endpoint with injected parameters.

For WordPress Multisite installations, the attacker injects a site parameter with target site IDs to enumerate and extract calendar events from any sub-site, including private calendars that should be inaccessible. By iterating through site IDs, an attacker can systematically harvest calendar data across the entire network.

For WordPress Single Site installations, the attack triggers a PHP fatal error by attempting to call the non-existent switch_to_blog() function, causing the PHP worker thread to crash. Repeated requests can effectively deny service to legitimate users.

Detection Methods for CVE-2026-40308

Indicators of Compromise

Unusual AJAX requests to the mc_ajax_mcjs_action endpoint from unauthenticated sources
Web server logs showing repeated requests with suspicious site parameter values
PHP fatal error logs indicating calls to undefined function switch_to_blog() on Single Site installations
Unexpected access patterns to calendar event data across multiple sub-sites

Detection Strategies

Monitor WordPress AJAX endpoints for anomalous request patterns from unauthenticated users
Implement Web Application Firewall (WAF) rules to detect and block requests with injected site parameters
Review PHP error logs for fatal errors related to switch_to_blog() function calls
Audit access logs for enumeration attempts targeting the My Calendar AJAX endpoints

Monitoring Recommendations

Enable detailed logging for WordPress AJAX requests and monitor for suspicious parameter injection
Set up alerts for PHP fatal errors on Single Site installations that may indicate active exploitation
Monitor for unusual data access patterns across WordPress Multisite sub-sites
Implement rate limiting on AJAX endpoints to mitigate denial of service attempts

How to Mitigate CVE-2026-40308

Immediate Actions Required

Update My Calendar plugin to version 3.7.7 or later immediately
Review access logs for signs of exploitation attempts targeting the vulnerable endpoint
On Multisite installations, audit calendar event access for unauthorized data exposure
Consider temporarily disabling the My Calendar plugin if immediate update is not possible

Patch Information

The vulnerability has been fixed in My Calendar version 3.7.7. The patch addresses the unsafe use of parse_str() by implementing proper input validation and authorization checks on the mc_ajax_mcjs_action AJAX endpoint. Users should update immediately through the WordPress plugin updater or by downloading the patched version from the GitHub Release v3.7.7. For complete technical details, refer to the GitHub Security Advisory GHSA-2mvx-f5qm-v2ch.

Workarounds

Restrict access to WordPress AJAX endpoints using web server configuration or WAF rules
Implement IP-based access controls to limit exposure of the vulnerable endpoint
On Multisite installations, consider network-level segmentation to limit cross-site access
Monitor and rate-limit requests to AJAX endpoints to mitigate denial of service impact

bash

# Example: Block unauthenticated access to the vulnerable AJAX action via .htaccess
# Add to WordPress .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} action=mc_ajax_mcjs_action [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>