CVE-2026-11896: Joedolson My Calendar – Accessible Event Manager

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.

Affected products

• Joedolson My Calendar – Accessible Event Manager: up to and including 3.7.14

Published 2026-07-02. Last modified 2026-07-02.