{"metadata": {"vulnerability": "CVE-2026-104798", "count": 19, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-10-02T13:12:10.980Z", "date_only": false, "value": "2026-10-02T13:12:10.980Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104798", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-02T13:27:02Z", "date_only": false, "value": "2026-10-02T13:27:02.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104798", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T16:25:37Z", "date_only": false, "value": "2026-10-15T16:25:37.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104798", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T04:27:04.876Z", "date_only": false, "value": "2026-10-16T04:27:04.876Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104798", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T04:27:04.876Z", "date_only": false, "value": "2026-10-16T04:27:04.876Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104798", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T04:45:45.050Z", "date_only": false, "value": "2026-10-16T04:45:45.050367Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448765896040502", "record": "CVE-2026-104798", "field": "creation_timestamp", "uuid": "0e71b57e-7d25-4b87-b0f4-74b6773d3f2a", "content": "CVE-2026-104798 My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute The My Calendar \u2013 Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated attackers to invoke arbitrary loaded PHP functions, enabling a call chain in which the shortcode `$params` array is passed to `edit_user()` \u2014 which PHP coerces to integer `1` as the `$user_id` argument \u2014 overwriting the credentials of the initial Administrator account (user ID 1) and granting the attacker full wp-admin access. Exploitation is trivially reachable via the plugin's auto-generated `/my-calendar/` page, which is publicly accessible by default upon plugin activation.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104798https://www.wordfence.com/threat-intel/vulnerabilities/id/e8aa6ee7-525e-4458-9f5b-1e729afe448c?source=cvehttps://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L248https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-navigation.php#L260https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L221https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-search.php#L170https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-shortcodes.php#L102https://plugins.trac.wordpress.org/browser/my-calendar/tags/3.8.6/my-calendar-output.php#L1622https://plugins.trac.wordpress.org/changeset?reponame=&old=3746389%40my-calendar&new=3746389%40my-calendar#wordpress #joedolson #MyCalendar\u2013AccessibleEventManager#CVE_2026_104798#bot", "url": "https://infosec.exchange/users/cve/statuses/117448765896040502"}, {"timestamp": "2026-10-16T05:00:07.465Z", "date_only": false, "value": "2026-10-16T05:00:07.465238Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxs6v4w232z", "record": "CVE-2026-104798", "field": "creation_timestamp", "uuid": "053c5503-e6cb-4b82-b0a3-9778a491ce34", "content": "CVE-2026-104798 - my calendar \u2013 accessible event manager\nThe My Calendar \u2013 Accessible Event Manager plugin for WordPress allows anyone on the internet to run code that can change the main administrator's login\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#joedolson #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxxs6v4w232z"}, {"timestamp": "2026-10-16T05:17:28Z", "date_only": false, "value": "2026-10-16T05:17:28Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JCJ4-JRHQ-CJVH", "record": "GHSA-JCJ4-JRHQ-CJVH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T05:17:28.580Z", "date_only": false, "value": "2026-10-16T05:17:28.580", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104798", "record": "FKIE_CVE-2026-104798", "field": "published"}, {"timestamp": "2026-10-16T05:53:17.413Z", "date_only": false, "value": "2026-10-16T05:53:17.413121Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/istc7ftytmpxa", "record": "CVE-2026-104798", "field": "creation_timestamp", "uuid": "d860139a-0eeb-4e22-9618-a0cb2764ce7b", "content": "CVE-2026-104798 - My Calendar\nCVE ID : CVE-2026-104798\n \n Published : Oct. 16, 2026, 5:17 a.m. | 16\u00a0minutes ago\n \n Description : The My Calendar \u2013 Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. T...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/istc7ftytmpxa"}, {"timestamp": "2026-10-16T06:07:19.382Z", "date_only": false, "value": "2026-10-16T06:07:19.382410Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxvx2kwfy2l", "record": "CVE-2026-104798", "field": "creation_timestamp", "uuid": "62ef3c2b-31a7-4df7-8eb9-77e818ea7734", "content": "\ud83d\udea8 CVE-2026-104798 \u2014 CVSS 9.8 CRITICAL\n\nThe My Calendar \u2013 Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in al...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-104798\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxxvx2kwfy2l"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JCJ4-JRHQ-CJVH", "record": "GHSA-JCJ4-JRHQ-CJVH", "field": "published"}, {"timestamp": "2026-10-16T06:30:26Z", "date_only": false, "value": "2026-10-16T06:30:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JCJ4-JRHQ-CJVH", "record": "GHSA-JCJ4-JRHQ-CJVH", "field": "modified"}, {"timestamp": "2026-10-16T16:48:56.803Z", "date_only": false, "value": "2026-10-16T16:48:56.803700Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104798", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T16:48:56.803Z", "date_only": false, "value": "2026-10-16T16:48:56.803700Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104798", "record": "FKIE_CVE-2026-104798", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T17:07:17.621Z", "date_only": false, "value": "2026-10-16T17:07:17.621Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104798", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T17:07:17.621Z", "date_only": false, "value": "2026-10-16T17:07:17.621Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104798", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T18:00:11.493Z", "date_only": false, "value": "2026-10-16T18:00:11.493243Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mxz5rraksx2f", "record": "CVE-2026-104798", "field": "creation_timestamp", "uuid": "b63375b8-d3cd-4bb5-ba8f-de8e5d1569a4", "content": "CVE-2026-104798. My Calendar plugin. 9.8/10. Unauthenticated attackers inject code into any page. Site takeover. Admin account hijack. No auth required.\n\nUpdate to 3.8.7 now.\n\nScan your WordPress site: pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mxz5rraksx2f"}, {"timestamp": "2026-10-16T18:17:20.360Z", "date_only": false, "value": "2026-10-16T18:17:20.360", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104798", "record": "FKIE_CVE-2026-104798", "field": "lastModified"}]}