このページはまだあなたの言語に翻訳されていません。翻訳作業中のため、英語でコンテンツを表示しています。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-7525: Authorization Bypass in My Calendar Plugin
プラットフォーム
wordpress
コンポーネント
my-calendar
修正版
3.7.10
CVE-2026-7525 describes an authorization bypass vulnerability affecting the My Calendar – Accessible Event Manager plugin for WordPress. An authenticated attacker with custom-level access or higher can manipulate the POST body to publish events or alter their status (e.g., cancelled, private) without proper authorization checks. This vulnerability impacts versions 0.0.0 through 3.7.9 and has been resolved in version 3.7.10.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
This vulnerability allows an attacker to bypass the intended moderation and approval workflow within the My Calendar plugin. An attacker with custom-level access can effectively impersonate a higher-privileged user, publishing events that would normally require administrator approval or changing event statuses to reflect cancellations or private settings. This could lead to unauthorized event postings, data manipulation, and potential disruption of scheduled events. The impact is amplified in environments where event scheduling is critical, such as educational institutions, event management platforms, or internal communication systems. Successful exploitation could also be used to inject malicious content into event descriptions or metadata, potentially leading to further attacks.
悪用の状況翻訳中…
CVE-2026-7525 was published on 2026-05-14. Severity is rated as MEDIUM (CVSS 4.3). No public exploits or active campaigns have been reported at the time of writing. The vulnerability is not currently listed on KEV or EPSS. Monitor security advisories and threat intelligence feeds for any indications of exploitation.
脅威インテリジェンス
エクスプロイト状況
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- 低 — 有効なユーザーアカウントがあれば十分。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- なし — 機密性への影響なし。
- Integrity
- 低 — 限定的な範囲でデータ変更可能。
- Availability
- なし — 可用性への影響なし。
影響を受けるソフトウェア
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2026-7525 is to immediately upgrade the My Calendar plugin to version 3.7.10 or later. If upgrading is not feasible due to compatibility issues or breaking changes, consider temporarily restricting user roles with custom-level access from modifying event statuses. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to filter suspicious POST requests targeting the plugin's event management endpoints can provide an additional layer of defense. Regularly review user roles and permissions to ensure they align with the principle of least privilege.
修正方法
バージョン 3.7.10、またはそれ以降の修正バージョンにアップデートしてください
よくある質問翻訳中…
What is CVE-2026-7525 — Authorization Bypass in My Calendar plugin?
CVE-2026-7525 is a medium severity authorization bypass vulnerability in the My Calendar plugin for WordPress, allowing attackers with custom-level access to bypass moderation and publish events without proper authorization.
Am I affected by CVE-2026-7525 in My Calendar plugin?
You are affected if your WordPress site uses the My Calendar plugin in versions 0.0.0 through 3.7.9. Upgrade to 3.7.10 or later to resolve the vulnerability.
How do I fix CVE-2026-7525 in My Calendar plugin?
Upgrade the My Calendar plugin to version 3.7.10 or later. If upgrading is not immediately possible, restrict custom-level users' ability to modify event statuses.
Is CVE-2026-7525 being actively exploited?
As of the current assessment, there are no reports of active exploitation or public exploits for CVE-2026-7525, but continuous monitoring is recommended.
Where can I find the official My Calendar advisory for CVE-2026-7525?
Refer to the official My Calendar plugin website and WordPress.org plugin page for updates and security advisories related to CVE-2026-7525.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
WordPressプロジェクトを今すぐスキャン — アカウント不要
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...