joedolson My Calendar Plugin up to 3.7.9 on WordPress POST Request authorization

Summaryinfo

A vulnerability classified as critical has been found in joedolson My Calendar Plugin up to 3.7.9 on WordPress. Affected by this vulnerability is an unknown functionality of the component POST Request Handler. The manipulation leads to authorization. This vulnerability is listed as CVE-2026-7525. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in joedolson My Calendar Plugin up to 3.7.9 on WordPress and classified as critical. This issue affects some unknown processing of the component POST Request Handler. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with custom-level access and above, to bypass the moderation and approval workflow by tampering with the POST body to publish events or set other unauthorized statuses such as cancelled or private, in ways their role does not permit. While the UI correctly restricts low-privilege users to a draft-only submit button, this restriction is enforced only client-side, making it trivially bypassable by directly manipulating the POST request.

The weakness was presented by M Indra Purnama. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2026-7525 since 04/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.7.4 eliminates this vulnerability. Applying the patch 98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-202605-3607). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Calendar Software

Vendor

• joedolson

Name

• My Calendar Plugin

Version

• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.7
• 3.7.8
• 3.7.9

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion