My Calendar <= 3.8.8 - Unauthenticated Sensitive Information Exposure via iCal Export
- ID
- WPSEC-2026-1255
- Plugin
- My Calendar – Accessible Event Manager (my-calendar)
- Affected
- all versions before 3.8.9
- Remediation
- Update to 3.8.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-20
- Attack surface
- My Calendar on WPSec AttackSurface
- Fix released
- Published
Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the iCal export (single-event 'vcal' downloads and iCal feeds/subscriptions) in all versions up to, and including, 3.8.8, due to the event host's name and email address always being written to the ORGANIZER field of the generated iCal data, with no regard for the host's visibility settings. This makes it possible for unauthenticated attackers to harvest the email addresses of the WordPress users assigned as event hosts (by default the event author, often a site administrator or editor), as well as contact details of custom hosts marked as private or hidden.
References
- https://wpsec.com/vuln/WPSEC-2026-1255/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.8.9/
- https://wordpress.org/plugins/my-calendar/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS