CVE-2026-11896
Received Received - Intake

Insecure Direct Object Reference in My Calendar WordPress Plugin

Publication date: 2026-07-02

Last updated on: 2026-07-02

Assigner: Wordfence

Description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-02
Last Modified
2026-07-02
Generated
2026-07-02
AI Q&A
2026-07-02
EPSS Evaluated
N/A
NVD
CVE-2026-11896
EUVD
EUVD-2026-41266

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
my_calendar accessible_event_manager to 3.7.14 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The My Calendar – Accessible Event Manager plugin for WordPress has a vulnerability called Insecure Direct Object Reference (IDOR) in all versions up to and including 3.7.14. This vulnerability arises because the plugin does not properly validate a user-controlled parameter named 'vcal'.

Due to this missing validation, unauthenticated attackers can enumerate occurrence IDs and access the full iCalendar export of calendar events that are non-public, draft, trashed, or personal. This means sensitive event metadata such as titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata can be disclosed without authorization.

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive calendar event information. Attackers who exploit it can access private and personal event details without authentication.

  • Exposure of sensitive event metadata such as titles, descriptions, dates, and locations.
  • Disclosure of organizer and host details.
  • Access to non-public, draft, trashed, and personal calendar events.

Such exposure could lead to privacy violations, information leakage, and potential misuse of the disclosed data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart