[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSJPcfQm9y8BVU1yZ6CuHuyFHl1p6uAcoJc56xUR8V90":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-11896","my-calendar-insecure-direct-object-reference-to-unauthenticated-sensitive-information-disclosure-via-vcal-parameter","My Calendar \u003C= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter","The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events, disclosing sensitive event metadata including titles, descriptions, dates, locations, organizer and host details, permalinks, and related calendar metadata.","my-calendar",null,"\u003C=3.7.14","3.7.15","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-01 20:04:38","2026-07-02 08:33:06",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fa72639df-fa05-414c-b30c-eb285f59d945?source=api-prod",1,[22,23,24,25,26,27,28,29],"css\u002Fadmin.css","css\u002Fmc-admin.css","css\u002Fmc-print.css","css\u002Fmc-styles.css","css\u002Fmc-user-styles.css","css\u002Freset.css","includes\u002Fcategory-icons.php","includes\u002Fconditionals.php","researched",false,3,"# Exploitation Research Plan: CVE-2026-11896 (My Calendar IDOR)\n\n## 1. Vulnerability Summary\nThe **My Calendar** plugin for WordPress (versions \u003C= 3.7.14) contains an Insecure Direct Object Reference (IDOR) vulnerability. The plugin exposes an iCalendar (.ics) export feature triggered by the `vcal` parameter. This feature fails to perform authorization checks on the event ID (occurrence ID) provided by the user. Consequently, unauthenticated attackers can access sensitive metadata for events that should be restricted, including Drafts, Trashed events, and Private events, by simply knowing or enumerating the ID.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** The main WordPress frontend (`\u002F` or `index.php`).\n- **HTTP Parameter:** `vcal` (GET parameter).\n- **Value:** An integer representing the `occurrence_id` of a calendar event.\n- **Authentication:** None (Unauthenticated).\n- **Preconditions:** The plugin must be active, and at least one non-public event (Draft, Private, or Trashed) must exist in the database.\n\n## 3. Code Flow (Inferred)\nSince the specific export handler file was not provided in the source dump but is referenced in the vulnerability description, the logic flow is as follows:\n1.  **Entry Point:** The plugin likely hooks into `init` or `wp_loaded` to monitor for the `vcal` parameter.\n2.  **Handler:** A function (likely `my_calendar_vcal()` or similar) identifies the presence of `$_GET['vcal']`.\n3.  **Data Retrieval:** The code takes the integer from `vcal` and queries the `wp_my_calendar` (or `wp_my_calendar_event`) table to retrieve the event details.\n4.  **Vulnerability:** The code proceeds to generate the ICS output headers (`text\u002Fcalendar`) and event body without calling authorization checks like `mc_event_is_hidden()` or `mc_event_published()` (found in `includes\u002Fconditionals.php`).\n5.  **Sink:** The event metadata is echoed to the output buffer, ending execution with `exit;` or `die;`.\n\n## 4. Nonce Acquisition Strategy\nAccording to the vulnerability description and standard behavior of iCal export links in this plugin, **no nonce is required** for the `vcal` parameter. These links are typically intended to be shareable\u002Fpublicly accessible for calendar synchronization.\n\nIf a nonce were required, it would be found in the frontend script localization or a hidden field. To verify:\n1.  Navigate to a public calendar page.\n2.  Use `browser_eval` to search for `mc_` prefixed variables:\n    `browser_eval(\"window.my_calendar_vars || window.mc_data\")`\n\nHowever, for this specific CVE (IDOR to sensitive info), the exploit is expected to be a direct GET request.\n\n## 5. Exploitation Strategy\nThe goal is to demonstrate that an unauthenticated request can retrieve an event that is NOT in a 'Public' state.\n\n### Step-by-Step Plan:\n1.  **Identify Occurrence ID:** Use WP-CLI to find the ID of a \"Draft\" or \"Private\" event.\n2.  **Request Export:** Send a GET request to the homepage with the `vcal` parameter set to that ID.\n3.  **Verify Content:** Check if the response contains the `BEGIN:VCALENDAR` header and the private event's title\u002Fdescription.\n\n### Request Details:\n- **URL:** `http:\u002F\u002Flocalhost:8080\u002Findex.php?vcal=[ID]`\n- **Method:** `GET`\n- **Headers:** `Accept: text\u002Fcalendar` (Optional, as the plugin forces the header).\n\n## 6. Test Data Setup\nThe PoC requires events with different statuses to prove the bypass.\n\n```bash\n# 1. Create a Public event (to find the baseline ID range)\nwp eval \"mc_insert_event(array('event_title'=>'Public Event','event_desc'=>'Visible','event_begin'=>'2026-01-01','event_time'=>'12:00:00','event_end'=>'2026-01-01','event_endtime'=>'13:00:00','event_approved'=>1));\"\n\n# 2. Create a Draft event (event_approved = 0)\nwp eval \"mc_insert_event(array('event_title'=>'Secret Draft','event_desc'=>'Confidential Info','event_begin'=>'2026-02-01','event_time'=>'12:00:00','event_end'=>'2026-02-01','event_endtime'=>'13:00:00','event_approved'=>0));\"\n\n# 3. Create a Trashed event (event_approved = 2)\nwp eval \"mc_insert_event(array('event_title'=>'Trashed Event','event_desc'=>'Should be gone','event_begin'=>'2026-03-01','event_time'=>'12:00:00','event_end'=>'2026-03-01','event_endtime'=>'13:00:00','event_approved'=>2));\"\n\n# 4. Identify the occurrence IDs\n# My Calendar stores occurrences in a separate table. We need the 'occur_id' from wp_my_calendar.\nwp db query \"SELECT occur_id, event_title, event_approved FROM wp_my_calendar INNER JOIN wp_my_calendar_events ON wp_my_calendar.occur_event_id = wp_my_calendar_events.event_id\"\n```\n\n## 7. Expected Results\n- **Unauthenticated Request:** A request to `?vcal=[DRAFT_ID]` should return an HTTP 200 response with `Content-Type: text\u002Fcalendar`.\n- **Information Disclosure:** The body of the response should contain:\n  - `SUMMARY:Secret Draft`\n  - `DESCRIPTION:Confidential Info`\n- **Baseline Comparison:** A properly secured application would either return a 404, a 403, or a generic calendar file with no event data for a draft ID when requested by an unauthenticated user.\n\n## 8. Verification Steps\n1.  **Check Response Headers:** `http_request` should show `Content-Type: text\u002Fcalendar; charset=UTF-8`.\n2.  **Verify Occurrence Mapping:** Use WP-CLI to confirm the `occur_id` used in the request corresponds to the draft event:\n    `wp db query \"SELECT event_approved FROM wp_my_calendar_events WHERE event_id = (SELECT occur_event_id FROM wp_my_calendar WHERE occur_id = [ID])\"`\n3.  **Confirm Lack of Authentication:** Ensure the `http_request` was made without any `Cookie` headers representing a logged-in user.\n\n## 9. Alternative Approaches\nIf the `vcal` parameter expects an `event_id` rather than an `occur_id`, or if the parameter is handled differently:\n- Try `?vcal=1` (standard IDOR enumeration).\n- Search the source for `add_action( 'init'` or `add_action( 'wp_loaded'` to find the exact function handling the `vcal` key.\n- If `vcal` is used in a redirect context (e.g., generating a file then redirecting), check if the file path is predictable in `wp-content\u002Fuploads\u002F`. (Unlikely given the \"sensitive information disclosure\" via parameter description).","The My Calendar plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the iCalendar export functionality. Unauthenticated attackers can disclose sensitive event details—including those of draft, private, or trashed events—by supplying a specific occurrence ID to the 'vcal' parameter, as the plugin lacks authorization checks on the event's visibility status.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmy-calendar\u002F3.7.0\u002Fcss\u002Fadmin.css \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmy-calendar\u002F3.7.15\u002Fcss\u002Fadmin.css\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmy-calendar\u002F3.7.0\u002Fcss\u002Fadmin.css\t2026-01-20 22:57:52.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fmy-calendar\u002F3.7.15\u002Fcss\u002Fadmin.css\t2026-06-14 19:35:06.000000000 +0000\n@@ -218,6 +218,10 @@\n \tcolor: var(--primary-dark);\n }\n \n+.mc_edit_links {\n+\tclear: both;\n+}\n+\n .mc_edit_links ul {\n \tdisplay: flex;\n \tgap: 10px;\n@@ -553,6 +557,7 @@\n \tfont-style: italic;\n }\n \n+.single-mc-event .mc-image,\n .mc-main .details .mc-image {\n \tmax-width: 100%;\n \theight: auto;\n... (truncated)","The exploit targets the iCalendar export feature triggered by the 'vcal' GET parameter. \n\n1. Endpoint: The attacker targets the WordPress root (index.php) or any page where the My Calendar plugin is active.\n2. Methodology: An unauthenticated attacker sends a GET request with the 'vcal' parameter set to an integer representing an event's occurrence ID (e.g., \u002F?vcal=123). \n3. Authentication: No authentication or specific nonces are required to access this endpoint.\n4. Payload\u002FBypass: By enumerating occurrence IDs, the attacker can bypass visibility restrictions. The plugin fails to verify if the event status is 'Public' or if the user has permission to view the event, causing the server to return the full event metadata (including sensitive summaries and descriptions) in a 'text\u002Fcalendar' (ICS) file format even for Drafts or Private events.","gemini-3-flash-preview","2026-07-25 11:15:20","2026-07-25 11:15:43",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","3.7.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmy-calendar\u002Ftags\u002F3.7.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmy-calendar.3.7.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmy-calendar\u002Ftags\u002F3.7.15","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmy-calendar.3.7.15.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmy-calendar\u002Ftags"]