CVE-2026-7525: Authorization Bypass in My Calendar Plugin

This vulnerability allows an attacker to bypass the intended moderation and approval workflow within the My Calendar plugin. An attacker with custom-level access can effectively impersonate a higher-privileged user, publishing events that would normally require administrator approval or changing event statuses to reflect cancellations or private settings. This could lead to unauthorized event postings, data manipulation, and potential disruption of scheduled events. The impact is amplified in environments where event scheduling is critical, such as educational institutions, event management platforms, or internal communication systems. Successful exploitation could also be used to inject malicious content into event descriptions or metadata, potentially leading to further attacks.

1. 已保留2026-04-30
2. 发布日期2026-05-13
3. 修改日期2026-05-14

The primary mitigation for CVE-2026-7525 is to immediately upgrade the My Calendar plugin to version 3.7.10 or later. If upgrading is not feasible due to compatibility issues or breaking changes, consider temporarily restricting user roles with custom-level access from modifying event statuses. While not a complete solution, implementing a Web Application Firewall (WAF) with rules to filter suspicious POST requests targeting the plugin's event management endpoints can provide an additional layer of defense. Regularly review user roles and permissions to ensure they align with the principle of least privilege.