CVE-2026-11896: WordPress My Calendar IDOR Vulnerability – Sensitive Event Disclosure

Technical summary

CVE-2026-11896 is an Insecure Direct Object Reference (IDOR) vulnerability in the My Calendar plugin affecting versions through 3.7.14. The vulnerability exists in the handling of the 'vcal' parameter, which is used to retrieve iCalendar exports. The plugin lacks sufficient validation on this user-controlled key, allowing attackers to enumerate occurrence IDs and directly access calendar event objects regardless of their publication status or access restrictions. The flaw exposes sensitive metadata through the full iCalendar export format, which contains structured event information including summaries, descriptions, dates, times, locations, organizer details, and permalinks. No authentication is required to exploit this vulnerability.

Business impact

Organizations using this plugin face unintended disclosure of sensitive scheduling information. Calendar data often contains business intelligence—meeting details, executive movement patterns, event locations, and attendee relationships—that competitors or bad actors could exploit for social engineering, physical security reconnaissance, or business strategy inference. Draft and personal calendars are especially sensitive, as they may contain confidential planning information. For multi-tenant WordPress deployments or sites serving multiple organizations, the risk of cross-tenant data leakage is significant. The low barrier to exploitation (no authentication, no user interaction) amplifies the business risk.

Affected systems

All installations of the My Calendar – Accessible Event Manager plugin running version 3.7.14 or earlier are vulnerable. Any WordPress site using this plugin is at risk, regardless of whether the calendar feature is actively used or visible to end users. Multisite WordPress installations may amplify exposure if multiple sites or organizations share the same plugin instance.

Exploitability

This vulnerability is straightforward to exploit. An attacker needs only to craft HTTP requests with manipulated 'vcal' parameter values—no special tools, authentication, or user interaction are required. The attack is entirely passive from the user's perspective and leaves minimal forensic traces in typical access logs. The enumeration of occurrence IDs can be performed rapidly, making bulk discovery of calendar events feasible. The CVSS score of 5.3 (Medium severity) reflects the confidentiality impact balanced against the lack of integrity or availability compromise, though the ease of exploitation and broad applicability warrant urgent attention.

Remediation

Update the My Calendar plugin to a patched version released after 3.7.14 that implements proper validation of the 'vcal' parameter. Before patching, consider temporarily disabling calendar export functionality or restricting access to the plugin's export endpoints via web application firewall rules or .htaccess restrictions. Review access logs for suspicious vcal parameter patterns to identify potential prior exploitation.

Patch guidance

Monitor the plugin's official WordPress repository and the developer's security advisories for a patched release. Once available, apply the update immediately—IDOR vulnerabilities are trivial to weaponize at scale. Verify the patch version against the official My Calendar plugin changelog and security notices before deployment. Test in a staging environment to ensure no functionality regressions with custom calendar configurations.

Detection guidance

Monitor HTTP request logs for unusual 'vcal' parameter values, particularly numeric sequences or IDs that differ from expected patterns. Look for requests to calendar export endpoints from unauthenticated or low-privilege sessions. Implement Web Application Firewall (WAF) rules to flag or block requests with suspicious vcal parameters. Check iCalendar access logs for volume spikes or unusual IP addresses accessing calendar exports. Review access patterns to draft, private, or trash calendar items via web server or plugin audit logs if available.

Why prioritize this

Although rated MEDIUM severity by CVSS, this vulnerability merits prompt prioritization because exploitation is trivial (no authentication, simple parameter manipulation), affects all plugin versions in the wild, and directly exposes sensitive business metadata. The lack of KEV/CISA active exploitation tracking does not diminish the risk—IDOR vulnerabilities are historically among the fastest to be weaponized once public. Organizations should patch or mitigate this within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a confidentiality impact (L) with no integrity or availability harm. The attack vector is network-based, requires no privileges or user interaction, and affects all installations. While not rated 'high' due to the absence of system compromise or data modification, the ease of exploitation, absence of any mitigating factors (PR:N, UI:N, AC:L), and breadth of affected sensitive data elevate real-world risk well above the numerical score suggests.

Frequently asked questions