Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

joedolson/my-calendar

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8PackagistPublished

    Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

    CVE-2026-40308 · GHSA-2mvx-f5qm-v2ch

    Affected
    • Packagist joedolson/my-calendar < 3.7.7
    Fixed in
    3.7.7· Vendor fix available
    Issue
    An unauthenticated Insecure Direct Object Reference (IDOR) and Denial of Service (DoS) vulnerability in the My Calendar plugin allows any unauthenticated user to extract calendar events (including private or hidden ones) from any sub-site on a WordPress Multisite network. On standard Single Site WordPress installations, this same endpoint crashes the PHP worker thread, creating an unauthenticated Denial of Service (DoS) vector. Details The vulnerability stems from the mcajaxmcjsaction AJAX function, which handles the mcjsaction endpoint. This endpoint is explicitly registered for unauthenticated users: When the behavior parameter is set to loadupcoming, the plugin accepts an args parameter from the $REQUEST array. Instead of validating specific expected arguments, the plugin unsafely passes the entire string into PHP's parsestr() function: This allows an attacker to inject arbitrary key-value pairs into the $args array. This array is then passed to the…

    Recommended action: Upgrade to 3.7.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →