WordPress Plugin Vulnerabilities

My Calendar < 3.7.7 - Unauthenticated Denial of Service

Description

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Denial of Service in all versions up to 3.7.7 (exclusive). This makes it possible for unauthenticated attackers to trigger a fatal error.

Affects Plugins

Plugin icon
my-calendar
Fixed in 3.7.7

References

CVE
CVE-2026-40308
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9082adc5-508d-47ac-a74a-868e2600e3d6

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
minhi1
Verified
No
WPVDB ID
bd4da0cb-1e73-4d11-8743-daee2bfbbc25

Timeline

Publicly Published
2026-04-16 (about 4 months ago)
Added
2026-07-30 (about 24 days ago)
Last Updated
2026-07-30 (about 24 days ago)

Other

Published
Title
Published
2025-02-17
Title
ProfileGrid – User Profiles, Groups and Communities < 5.9.4.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure
Published
2026-06-30
Title
Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR
Published
2026-03-14
Title
COMPE < 1.1.5 - Unauthenticated Insecure Direct Object Reference
Published
2025-04-01
Title
JS Job Manager <= 2.0.2 - Authenticated Insecure Direct Object Reference
Published
2024-11-21
Title
Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure