CVE-2026-40308

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.

• CWE-639

• https://github.com/joedolson/my-calendar/releases/tag/v3.7.7
• https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch
• https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch

Published

Apr 16, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40301DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Pri…4.7
• CVE-2026-40302zrok is software for sharing web services, files, and networ…6.1
• CVE-2026-40303zrok is software for sharing web services, files, and networ…7.5
• CVE-2026-40304zrok is software for sharing web services, files, and networ…5.3
• CVE-2026-40305DNN (formerly DotNetNuke) is an open-source web content mana…4.3
• CVE-2026-40306DNN (formerly DotNetNuke) is an open-source web content mana…6.5
• CVE-2026-40309Masa CMS is a content management system forked from Mura CMS…7.2
• CVE-2026-4031The Database Backup for WordPress plugin for WordPress is vu…7.5
• CVE-2026-40310ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-40311ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-40312ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-40313PraisonAI is a multi-agent teams system. In versions 4.5.139…9.1