CVE-2026-104798: My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's doshortcode filter runs, allowing an unauthenticated attacker to inject a nested [mycalendar above=...] shortcode; mcgeneratecalendarnav() then splits the above attribute on commas and dispatches each element via calluserfunc() with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode $params array is passed to edituser() — which PHP coerces to integer 1 as the $userid argument — overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated /my-calendar/ page, which is publicly accessible by default upon plugin activation.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Sites running My Calendar – Accessible Event Manager version 3.8.7 or earlier are affected. The plugin's auto-generated /my-calendar/ page is publicly accessible by default when the plugin is activated, making the vulnerable path reachable without special configuration.
What access does an attacker need to exploit this issue?
No authentication, authorization, or user interaction is required. An attacker can supply the public mcs GET parameter to inject a nested shortcode and reach arbitrary loaded PHP function calls.
What is the practical impact of successful exploitation?
An attacker can use the disclosed call chain to invoke edit_user() in a way that targets user ID 1, overwriting the initial Administrator account's credentials. This gives the attacker full wp-admin access.
How can I determine whether a site is potentially affected?
Check whether My Calendar – Accessible Event Manager is installed at version 3.8.7 or earlier and whether its /my-calendar/ page is publicly reachable. The described vulnerable route is available through that page by default after plugin activation.