Vulnerability intelligence

CVE-2026-6854

joedolson My Calendar – Accessible Event Manager CWE-89

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS Score

7.5

High

EPSS — Exploit Probability

1.6%

Riskier than 75% of all CVEs · checked 2026-10-06

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Oct 6, 2026 · latest Oct 6, 2026

Coverage timeline

ClickFix Attack Hides Malware in Browser Cache to Evade Detection
thehackernews.com · Oct 6, 2026