CVE Database /
CVE-2023-6360
CVE · Critical
CVE-2023-6360 — My Calendar – Accessible Event Manager [my-calendar] < 3.4.22
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2023-6360
|
My Calendar – Accessible Event Manager [my-calendar] < 3.4.22 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
Critical
9.8
|
< 3.4.22
|
3.4.22 |
2023-11-26 |
—
|
CVE-2023-6360
The My Calendar plugin for WordPress contains a SQL injection flaw in the REST API endpoint /my-calendar/v1/events affecting versions 3.4.21 and earlier. The vulnerability exists in the 'from' and 'to' parameters, which are not properly escaped or prepared in the SQL query construction. Unauthenticated attackers can exploit this weakness to inject malicious SQL commands and extract sensitive data from the WordPress database.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings