{
 "id": "WPSEC-2026-1255",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1255/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1255/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1255/index.md",
 "title": "My Calendar <= 3.8.8 - Unauthenticated Sensitive Information Exposure via iCal Export",
 "description": "The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the iCal export (single-event 'vcal' downloads and iCal feeds/subscriptions) in all versions up to, and including, 3.8.8, due to the event host's name and email address always being written to the ORGANIZER field of the generated iCal data, with no regard for the host's visibility settings. This makes it possible for unauthenticated attackers to harvest the email addresses of the WordPress users assigned as event hosts (by default the event author, often a site administrator or editor), as well as contact details of custom hosts marked as private or hidden.",
 "plugin": {
  "slug": "my-calendar",
  "name": "My Calendar",
  "full_name": "My Calendar – Accessible Event Manager",
  "wordpress_org": "https://wordpress.org/plugins/my-calendar/",
  "advisories_url": "https://wpsec.com/vuln/plugin/my-calendar/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/my-calendar"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.9",
 "remediation": "Update to 3.8.9 or later.",
 "fix_released": "2026-10-18T20:06:29+00:00",
 "published": "2026-10-20T10:08:26+00:00",
 "updated": "2026-10-20T09:12:36.333253+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1255/",
  "https://plugins.svn.wordpress.org/my-calendar/tags/3.8.9/",
  "https://wordpress.org/plugins/my-calendar/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/my-calendar",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-20"
 }
}