# My Calendar <= 3.8.7 - Unauthenticated Arbitrary Function Call via Calendar Navigation 'above' and 'below' Attributes

- **ID:** WPSEC-2026-1025
- **Plugin:** My Calendar – Accessible Event Manager (`my-calendar`), https://wordpress.org/plugins/my-calendar/
- **Affected versions:** from 3.8.0 before 3.8.8
- **Fixed in:** 3.8.8 (Update to 3.8.8 or later.)
- **Severity:** Critical 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/my-calendar
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1025/

## Description

The My Calendar plugin for WordPress is vulnerable to arbitrary function calls via the calendar navigation 'above' and 'below' attributes in versions 3.8.0 to 3.8.7, due to navigation values that are not one of the plugin's navigation elements being passed to call_user_func() whenever a PHP function of that name exists. Contributors can set these attributes through the calendar shortcode, and unauthenticated attackers can set them through the shortcode injection fixed in the same release. This makes it possible for unauthenticated attackers to call arbitrary PHP functions on the site, which can lead to privilege escalation.

## References

- https://wpsec.com/vuln/WPSEC-2026-1025/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.8.8/
- https://wordpress.org/plugins/my-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1025/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.