Secure WordPress Sites Against Unauthenticated Admin Takeover in My Calendar
A critical flaw in the My Calendar plugin allows attackers to hijack administrator accounts without credentials, granting full control over affected WordPress sites.
Key points
- The vulnerability affects My Calendar plugin versions up to and including 3.8.7.
- Attackers can escalate privileges to admin status without any authentication.
- The National Vulnerability Database rates the flaw as critical with a CVSS of 9.8.
An unauthenticated attacker can now seize full administrative control of a WordPress site running the My Calendar plugin. By exploiting a flaw in the event manager, malicious actors can overwrite the credentials of the primary administrator account. This action grants them complete access to the site’s backend management tools and data without needing a username or password.
The National Vulnerability Database identifies this issue as CVE-2026-104798. It assigns the vulnerability a CVSS score of 9.8, which classifies it as critical. The flaw exists in all versions of the My Calendar – Accessible Event Manager plugin up to and including version 3.8.7. This means any site using these older versions is exposed to immediate compromise by anyone on the internet.
How the attack works
The attack relies on a publicly accessible page generated by the plugin. When the My Calendar plugin is activated, it creates a default page at the `/my-calendar/` URL. This page is open to the public by default. Attackers can send a specially crafted request to this endpoint. The request includes unsanitized data that the plugin processes without verifying the user’s identity or permissions.
The plugin fails to sanitize input before passing it through WordPress core filters. This allows an attacker to inject malicious code into the page content. The system then executes this injected code using a function that calls arbitrary PHP functions. This chain of events enables the attacker to manipulate the site’s user database directly.
Who is affected
Any WordPress site using the My Calendar plugin is at risk if it has not been updated. The vulnerability affects all versions up to 3.8.7. Small-business owners who rely on this plugin for event scheduling need to check their current version immediately. If the installed version is 3.8.7 or lower, the site is vulnerable.
The primary target is the administrator account with user ID 1. This is typically the first account created when setting up WordPress. Compromising this account gives the attacker the highest level of access. They can modify content, install malicious plugins, or steal sensitive data stored in the site’s database.
What to watch
No fix has been confirmed yet in the provided source material. Users should monitor official channels for a patched version of the plugin. Until a secure update is available, consider disabling the plugin if it is not essential for daily operations. Watch for unusual activity in the WordPress admin dashboard or unexpected changes to user permissions.
What made it possible
This incident illustrates the dangers of inadequate input validation in web applications. The weakness stems from trusting user-supplied data without proper sanitization or authorization checks. In intrusion terms, this serves as the initial access and privilege escalation stage. Teams usually encounter this when developers fail to validate parameters before processing them. Check whether your systems enforce strict allowlists for function calls. Ensure that public-facing endpoints do not execute code based on unverified user input. This class of flaw often leads to remote code execution.
Background: Privilege escalation vulnerabilities
Remove local administrator rights from daily users and enforce strict application whitelisting. These two steps block the majority of local privilege escalation attempts. Disable unused services and update dependencies to close known pathways that attackers use to gain higher system access.
Read the full guide: Stop Privilege Escalation: 5 Actions to Block Local Attacks
What to do and how to stay safe: My Calendar
- Check the version of the My Calendar plugin installed on your WordPress site immediately.
- If you are running version 3.8.7 or lower, disable the plugin pending a security update from the vendor.
- Monitor your server logs for suspicious requests to the `/my-calendar/` endpoint or other plugin-specific URLs.
- Ensure you have recent backups of your WordPress database and files in case of a compromise.
Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the My Calendar plugin vulnerability?
The National Vulnerability Database rates CVE-2026-104798 with a CVSS score of 9.8, which is classified as critical.
Which versions of the My Calendar plugin are affected by this flaw?
All versions of the My Calendar – Accessible Event Manager plugin up to and including version 3.8.7 are vulnerable.
Do attackers need a login to exploit this vulnerability?
No, the flaw allows unauthenticated attackers to exploit the vulnerability without needing any credentials or access.
