CVE-2026-6854: My Calendar WordPress Plugin SQLi Flaw

CVE-2026-6854 Overview

CVE-2026-6854 is a time-based blind SQL Injection vulnerability in the My Calendar – Accessible Event Manager plugin for WordPress. The flaw affects all plugin versions up to and including 3.7.8. It resides in the handling of the mc_auth parameter, which lacks proper escaping and query preparation. Unauthenticated attackers can append additional SQL statements to existing queries over the network. Successful exploitation allows extraction of sensitive information from the WordPress database, including user credentials and session data. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive data from the WordPress database via crafted mc_auth parameter values.

Affected Products

My Calendar – Accessible Event Manager plugin for WordPress
All versions up to and including 3.7.8
WordPress sites with the plugin enabled and publicly reachable

Discovery Timeline

2026-07-08 - CVE-2026-6854 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-6854

Vulnerability Analysis

The My Calendar plugin processes the mc_auth request parameter and incorporates its value into an SQL query without sufficient sanitization or use of prepared statements. Because the parameter is concatenated directly into the query, attacker-controlled SQL fragments alter the query's logic. Attackers exploit this using time-based blind techniques, injecting conditional SLEEP() or BENCHMARK() payloads. The database response latency reveals whether an injected boolean condition evaluates as true. Through iterative queries, an attacker enumerates database contents one character at a time. No authentication is required, and the attack occurs over standard HTTP or HTTPS.

Root Cause

The root cause is insufficient escaping of user-supplied input and the absence of parameterized queries. WordPress provides $wpdb->prepare() for safe query construction, but the affected code path bypasses this protection when handling mc_auth. The plugin trusts the raw parameter value and passes it into a dynamically constructed query.

Attack Vector

An unauthenticated attacker sends HTTP requests to endpoints that accept the mc_auth parameter. The attacker appends SQL syntax that alters the intended query, then observes server response times to infer database contents. Because the network attack surface is exposed and no user interaction is required, automated scanning tools can identify and exploit vulnerable sites at scale. Impact is limited to confidentiality — attackers can read data but cannot directly modify it through this vector alone.

No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-6854

Indicators of Compromise

HTTP requests containing mc_auth parameter values with SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or AND 1=
Unusually long server response times correlated with requests referencing mc_auth
High request volume from a single source targeting My Calendar plugin endpoints
Web server access logs showing repeated parameter variations against calendar-related URLs

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the mc_auth parameter for SQL metacharacters and time-delay functions
Enable query logging on MySQL/MariaDB and alert on statements containing SLEEP() originating from WordPress
Correlate HTTP request duration with parameter contents to detect blind SQLi probing patterns
Monitor WordPress plugin inventory for my-calendar at version 3.7.8 or earlier

Monitoring Recommendations

Ingest web server, WAF, and database logs into a centralized SIEM for correlation
Alert on repeated failed or delayed requests matching known blind SQLi signatures
Track outbound data volumes from WordPress hosts to detect large-scale extraction

How to Mitigate CVE-2026-6854

Immediate Actions Required

Update the My Calendar plugin to a version later than 3.7.8 as soon as a patched release is available
Audit WordPress sites for the presence and version of the My Calendar plugin
Review database access logs for suspicious queries referencing calendar tables
Rotate WordPress administrator credentials and API keys if exploitation is suspected

Patch Information

A fix has been committed upstream. Review the WordPress Plugin Update Notice for the code changeset that addresses the improper input handling on the mc_auth parameter. Apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Disable the My Calendar plugin until a patched version is installed
Configure WAF rules to block requests containing SQL syntax in the mc_auth parameter
Restrict access to WordPress endpoints exposing the plugin using IP allow-lists where feasible
Enable database user least-privilege configuration so the WordPress database account cannot read sensitive tables outside its scope

bash

# Update My Calendar plugin via WP-CLI
wp plugin update my-calendar

# Verify the installed version
wp plugin get my-calendar --field=version

# Temporarily deactivate if a patched version is not yet available
wp plugin deactivate my-calendar