# CVE-2026-40308: My-calendar - Information Disclosure

> Live exploitation tracking for CVE-2026-40308 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-40308

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Joe Dolson My-calendar
- **Weaknesses:** CWE-639 (Authorization Bypass Through User-Controlled Key)
- **Tags:** wordpress, cms

## Description

My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parse_str() without validation, allowing injection of arbitrary parameters including a site value. On WordPress Multisite installations, this enables an unauthenticated attacker to call switch_to_blog() with an arbitrary site ID and extract calendar events from any sub-site on the network, including private or hidden events. On standard Single Site installations, switch_to_blog() does not exist, causing an uncaught PHP fatal error and crashing the worker thread, creating an unauthenticated denial of service vector. This issue has been fixed in version 3.7.7.

## CrowdSec analysis

[CVE-2026-40308](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-40308) is an information disclosure vulnerability in the My Calendar WordPress plugin versions 3.7.6 and below. This flaw allows unauthenticated attackers to exploit the mc_ajax_mcjs_action AJAX endpoint to inject arbitrary parameters, enabling them to access calendar events—including private or hidden ones—across any sub-site in a WordPress Multisite network. On single-site installations, the vulnerability can be leveraged to crash the worker thread, resulting in a denial of service. This issue has been addressed in version 3.7.7.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-40308 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/wp-admin/admin-ajax.php` endpoint with the `action=mcjs_action` parameter to trigger information disclosure or denial of service in vulnerable My Calendar WordPress plugin installations.

## Timeline

- 2026-04-16: CVE Published. CVE-2026-40308 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2026-40308 exploitation attempts against the CrowdSec Network.
- 2026-08-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-40308 for the first time.

## References

- https://github.com/joedolson/my-calendar/releases/tag/v3.7.7
- https://github.com/joedolson/my-calendar/security/advisories/GHSA-2mvx-f5qm-v2ch
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-40308.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-40308) follows observed exploitation activity for CVE-2026-40308. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.