# My Calendar <= 3.8.8 - Unauthenticated Sensitive Information Exposure via iCal Export

- **ID:** WPSEC-2026-1255
- **Plugin:** My Calendar – Accessible Event Manager (`my-calendar`), https://wordpress.org/plugins/my-calendar/
- **Affected versions:** all versions before 3.8.9
- **Fixed in:** 3.8.9 (Update to 3.8.9 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-20)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/my-calendar
- **Fix released:** 2026-10-18
- **Published:** 2026-10-20
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1255/

## Description

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via the iCal export (single-event 'vcal' downloads and iCal feeds/subscriptions) in all versions up to, and including, 3.8.8, due to the event host's name and email address always being written to the ORGANIZER field of the generated iCal data, with no regard for the host's visibility settings. This makes it possible for unauthenticated attackers to harvest the email addresses of the WordPress users assigned as event hosts (by default the event author, often a site administrator or editor), as well as contact details of custom hosts marked as private or hidden.

## References

- https://wpsec.com/vuln/WPSEC-2026-1255/
- https://plugins.svn.wordpress.org/my-calendar/tags/3.8.9/
- https://wordpress.org/plugins/my-calendar/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1255/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.