My Calendar <= 3.6.17 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes
- ID
- WPSEC-2026-1021
- Plugin
- My Calendar – Accessible Event Manager (my-calendar)
- Affected
- from 3.6.0 before 3.6.18
- Remediation
- Update to 3.6.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- My Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The My Calendar plugin for WordPress is vulnerable to arbitrary function calls via the calendar navigation 'above' and 'below' attributes in versions 3.6.0 to 3.6.17, due to navigation values that are not one of the plugin's navigation elements being passed to call_user_func() whenever a PHP function of that name exists. Contributors can set these attributes through the calendar shortcode, and unauthenticated attackers can set them through the shortcode injection fixed in the same release. This makes it possible for unauthenticated attackers to call arbitrary PHP functions on the site, which can lead to privilege escalation.
References
- https://wpsec.com/vuln/WPSEC-2026-1021/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.6.18/
- https://wordpress.org/plugins/my-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS