My Calendar vulnerabilities

My Calendar (WordPress plugin) versions 3.7.6 and below have a vulnerability in the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users. User-supplied arguments are passed through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite, this enables an unauthenticated attacker to call switch_to_blog() and extract calendar events from any sub-site, including private ones. On Single Site, it causes an uncaught PHP fatal error and crashes the worker thread (DoS).

The My Calendar – Accessible Event Manager plugin for WordPress (versions up to and including 3.8.7) is vulnerable to privilege escalation. The mcs parameter is reflected unsanitized, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode, which then calls arbitrary PHP functions via call_user_func(), including edit_user(), leading to administrator account takeover.

The My Calendar plugin by Joe Dolson for WordPress up to version 3.6.16 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can exploit this to perform unauthorized actions.