HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-6854 — The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to...

·Source: NIST NVD

Updated:

Executive Summary

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into alr

Analysis

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'mc_auth' parameter in all versions up to, and including, 3.7.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSS Score: 7.5. Published: 2026-07-08T12:17:21.137.

Indicators of Compromise (1)

CVE (1)
CVE-2026-6854
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

SBS embeds AI into core banking platform

SBS, the global financial technology company that more than 1,500 financial institutions rely on to digitally transform the way they operate, is launching SBS AI Foundation, embedding enterprise AI directly into the core banking, lending, and digital banking products its clients already run.

Finextra
MEDIUMVulnerabilityNEW

Spain arrests alleged supporter of pro-Russian hacktivist groups after FBI tip

An FBI tip linked a man living in Spain to the hacking groups CyberArmy of Russia Reborn (CARR), Z-Pentest and NoName057(16).

The Record
CRITICALVulnerability

NVD CRITICAL: CVE-2026-8307 — Improper neutralization of special elements used in an SQL command ('SQL injecti...

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVE-2026-8307
NIST NVD