CVE-2026-11896 Information disclosure in My Calendar – Accessible Event Manager
Unauthenticated attackers can access sensitive private calendar event details via insecure direct object reference in the My Calendar plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11896?
CVE-2026-11896 is a medium-severity vulnerability in joedolson My Calendar – Accessible Event Manager, published on 2 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.
Weakness: CWE-639
Which versions are affected by CVE-2026-11896?
How do I fix CVE-2026-11896?
No fix has been published for CVE-2026-11896 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11896 being exploited?
There is no known exploitation of CVE-2026-11896 in the wild and no public exploit code.
Sources
Also known as GHSA-rfww-46mr-4mrf.