CVE-2025-67592: WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67592?
CVE-2025-67592 is classified as a missing authorization vulnerability with potential exploitation risks due to incorrectly configured access control security levels.
How do I fix CVE-2025-67592?
To fix CVE-2025-67592, update the My Calendar plugin to the latest version that is greater than 3.6.16.
Which versions of My Calendar are affected by CVE-2025-67592?
CVE-2025-67592 affects My Calendar versions from n/a up to and including 3.6.16.
What is the impact of exploiting CVE-2025-67592?
Exploiting CVE-2025-67592 could allow unauthorized access to features and data that should be protected by access control.
Is there a workaround for CVE-2025-67592 if I cannot immediately update?
While not ideal, temporarily restricting access to the My Calendar plugin or limiting user roles could serve as a workaround until an update can be applied.