WordPress My Calendar Plugin Privilege Escalation Vulnerability

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.8.7. The public mcs GET parameter is reflected into post content unsanitized before WordPress core's do_shortcode filter runs, allowing an unauthenticated attacker to inject a nested [my_calendar above=...] shortcode.

When processed, mc_generate_calendar_nav() splits the above attribute on commas and dispatches each element via call_user_func() with no authentication, authorization, or callable allowlist check. This lets unauthenticated attackers invoke arbitrary loaded PHP functions.

In a call chain, the shortcode $params array is passed to edit_user(), which PHP coerces to integer 1 as the $user_id argument, overwriting the credentials of the initial Administrator account (user ID 1) and granting full wp-admin access.

• Affected: all versions up to and including 3.8.7
• Attack vector: unauthenticated via the public mcs parameter
• Impact: full WordPress admin access by overwriting Administrator user ID 1 credentials
• Exploitation is trivially reachable via the plugin's auto-generated /my-calendar/ page, publicly accessible by default upon activation.