CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter

🗓️ 14 May 2026 03:27:14Reported by WordfenceType

Authenticated attackers can bypass event moderation by tampering POST data to publish events in My Calendar up to version 3.7.9.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-7525	14 May 202603:27	–	attackerkb
Circl	CVE-2026-7525	15 May 202606:32	–	circl
CNNVD	WordPress plugin My Calendar – Accessible Event Manager 安全漏洞	14 May 202600:00	–	cnnvd
CVE	CVE-2026-7525	14 May 202603:27	–	cve
EUVD	EUVD-2026-30217	14 May 202603:27	–	euvd
NVD	CVE-2026-7525	14 May 202605:16	–	nvd
Patchstack	WordPress My Calendar – Accessible Event Manager plugin <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication vulnerability	13 May 202600:00	–	patchstack
Positive Technologies	PT-2026-40850	14 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-7525	5 Jun 202619:39	–	redhatcve
Vulnrichment	CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter	14 May 202603:27	–	vulnrichment

[
  {
    "vendor": "joedolson",
    "product": "My Calendar – Accessible Event Manager",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.7.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/3e27c0b0-c74f-47ad-b9ed-9fd6bd05d040
github	www.github.com/joedolson/my-calendar/commit/98aef8fbfc6ca4cfe50aaa36761d5f1eb629dfe4
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-event-editor.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.4/my-calendar-event-editor.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-event-editor.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/trunk/my-calendar-event-editor.php
plugins	www.plugins.trac.wordpress.org/browser/my-calendar/tags/3.7.9/my-calendar-event-editor.php

14 May 2026 03:27Current

CVSS 3.14.3

EPSS0.00341

CWE-862