CVE-2025-67592

MediumCVSS 4.3

Published: 09/12/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The My Calendar plugin by Joe Dolson for WordPress up to version 3.6.16 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can exploit this to perform unauthorized actions.

Risk Assessment

The risk involves potential unauthorized access to calendar functions, which could lead to data manipulation or privilege escalation within WordPress.

Recommendation

It is recommended to update the My Calendar plugin to a version newer than 3.6.16 and review access control configurations.

Other vulnerabilities in My Calendar

CVE-2026-40308High
My Calendar (WordPress plugin) versions 3.7.6 and below have a vulnerability in the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users. User-supplied arguments are passed through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite, this enables an unauthenticated attacker to call switch_to_blog() and extract calendar events from any sub-site, including private ones. On Single Site, it causes an uncaught PHP fatal error and crashes the worker thread (DoS).

Original NVD description (English source)

Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS