CVE-2026-11896 My Calendar <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter

🗓️ 02 Jul 2026 08:33:06Reported by WordfenceType

Unauthenticated access to calendar exports via vcal in WordPress calendar plugin up to version 3.7.14.

Reporter	Title	Published	Views	Family All 5
CVE	CVE-2026-11896	2 Jul 202608:33	–	cve
EUVD	EUVD-2026-41266	2 Jul 202608:33	–	euvd
NVD	CVE-2026-11896	2 Jul 202610:16	–	nvd
Patchstack	WordPress My Calendar – Accessible Event Manager plugin <= 3.7.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability	1 Jul 202620:04	–	patchstack
Positive Technologies	PT-2026-54938	2 Jul 202600:00	–	ptsecurity

[
  {
    "vendor": "joedolson",
    "product": "My Calendar – Accessible Event Manager",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.7.14",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/my-calendar-api.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-api.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/my-calendar-events.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-api.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.14/my-calendar.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a72639df-fa05-414c-b30c-eb285f59d945
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/includes/ical.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/includes/date-utilities.php
plugins	www.plugins.trac.wordpress.org/changeset

02 Jul 2026 08:33Current

CVSS 3.15.3

CWE-639