CVE-2026-40308: My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog
joedolson · my-calendar
Affected: joedolson my-calendar · Exploitation: check available, not yet exploited
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 61% of scored CVEs
DescriptionCVE.org
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- joedolson · my-calendar< 3.7.7
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
- CISA KEV
- Not listed
- Public check
- My Calendar WordPress Plugin - Information Disclosure · nuclei template in projectdiscovery/nuclei-templates
- Weakness
- Insecure Direct Object Reference
- Vendor
- joedolson
- Published
- April 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-40308 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.