GHSA-2mvx-f5qm-v2ch Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog in My Calendar

• Packagist joedolson/my-calendar: < 3.7.7 → fixed in 3.7.7

Summary An unauthenticated Insecure Direct Object Reference (IDOR) and Denial of Service (DoS) vulnerability in the My Calendar plugin allows any unauthenticated user to extract calendar events (including private or hidden ones) from any sub-site on a WordPress Multisite network. On standard Single Site WordPress installations, this same endpoint crashes the PHP worker thread, creating an unauthenticated Denial of Service (DoS) vector. Details The vulnerability stems from the `mc_ajax_mcjs_action AJAX` function, which handles the `mcjs_action` endpoint. This endpoint is explicitly registered for unauthenticated users: ```php /wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=2" ``` 2. Single Site Denial of Service (DoS) If the WordPress instance is not a Multisite, passing any truthy value to the site parameter will instantly crash the request thread: ``` curl -i -s "http:///wp-admin/admin-ajax.php?action=mcjs_action&behavior=loadupcoming&args=site=1" ``` Impact Vulnerability Type: Insecure Direct Object Reference (IDOR) / Information Exposure / Denial of Service (DoS) Who is impacted: All sites running the "My Calendar" plugin. Anonymous internet users can silently map the network and extract private, unpublished, or intranet-specific events from unlaunched/internal sub-sites. Standard Single Site users are vulnerable to an easy-to-execute application-layer DoS, as it costs an attacker negligible resources to constantly crash PHP worker threads at an unauthenticated endpoint.