CVE-2026-7525: My Calendar WordPress Auth Bypass Flaw

CVE-2026-7525 Overview

CVE-2026-7525 is an authorization bypass vulnerability [CWE-862] in the My Calendar – Accessible Event Manager plugin for WordPress. The flaw affects all plugin versions up to and including 3.7.9. The plugin fails to verify that an authenticated user is authorized to perform event status changes on the server side. Authenticated attackers with custom-level access or above can tamper with the POST body to bypass the moderation workflow. This allows them to publish events or assign unauthorized statuses such as cancelled or private, even when their role only permits draft submissions.

Critical Impact

Authenticated low-privilege users can bypass content moderation controls and publish or alter event statuses outside their assigned role permissions.

Affected Products

• My Calendar – Accessible Event Manager plugin for WordPress
• All versions up to and including 3.7.9
• WordPress installations exposing custom-level (or higher) user registration

Discovery Timeline

• 2026-05-14 - CVE-2026-7525 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-7525

Vulnerability Analysis

The My Calendar plugin implements an event submission workflow with role-based restrictions on event status assignment. Low-privilege users should be limited to submitting events as drafts that require moderator approval. However, the plugin enforces this restriction only in the client-side user interface by rendering a draft-only submit button.

The server-side handler in my-calendar-event-editor.php accepts the event status field from the POST request without re-validating it against the user's role capabilities. An attacker can intercept the form submission and modify the status parameter to values such as publish, cancelled, or private. The backend then persists the chosen status, bypassing the intended moderation gate.

Root Cause

The root cause is missing authorization [CWE-862] on the event status field within the event editor logic. The relevant code paths at lines 406, 601, and 2384 in my-calendar-event-editor.php process the submitted status without invoking a capability check tied to the user's role. Client-side UI controls are treated as a security boundary, which is trivially bypassable.

Attack Vector

Exploitation requires an authenticated session with custom-level access or higher on the target WordPress site. The attacker submits a crafted POST request to the event editor endpoint, replacing the status value the UI would have sent with an unauthorized status. No user interaction beyond the attacker's own session is required. The vulnerability is exploitable over the network against any WordPress site running an affected version of the plugin where low-privilege accounts can submit events.

For patch and code-path details, see the GitHub commit and the Wordfence Vulnerability Intel entry.

Detection Methods for CVE-2026-7525

Indicators of Compromise

• Events appearing with status publish, cancelled, or private that were submitted by users whose roles only permit draft submissions.
• POST requests to the My Calendar event editor endpoint containing status values inconsistent with the submitting user's role.
• Unexpected event entries in the wp_my_calendar database table created by non-moderator accounts.

Detection Strategies

• Review WordPress audit logs and database records for events whose author lacks publish capability but whose status is not draft.
• Inspect web server access logs for POST requests to admin.php?page=my-calendar or related plugin endpoints originating from low-privilege user sessions.
• Compare event submissions against role definitions to flag status values that exceed the submitter's permissions.

Monitoring Recommendations

• Enable a WordPress activity logging plugin to record event status changes with originating user and role.
• Alert when accounts with custom-level access create events with non-draft status values.
• Periodically audit user roles and capabilities to confirm least-privilege assignment for event contributors.

How to Mitigate CVE-2026-7525

Immediate Actions Required

• Update the My Calendar – Accessible Event Manager plugin to a version newer than 3.7.9 that includes the authorization fix referenced in the upstream commit.
• Audit existing events created by low-privilege users and revert any with unauthorized statuses back to draft pending review.
• Review WordPress user accounts and remove or downgrade unnecessary custom-level access where event submission is not required.

Patch Information

The maintainer addressed the issue in the upstream commit 98aef8f, which adds server-side capability checks to the event status handling paths. Refer to the WordPress changeset for the released fix.

Workarounds

• Restrict event submission capability to trusted roles only until the plugin is updated.
• Deploy a web application firewall rule to inspect POST requests to the event editor and reject status values other than draft for non-moderator accounts.
• Disable public or self-service user registration on affected WordPress sites to limit who can reach the vulnerable endpoint.