2026-10-16T03:13:35Z https://njump.me Joe Dolson (Unofficial) https://njump.me/npub1lfx03mcpp36ftyf4pfcn0w2dgz9grum4szezcn0cc00spss9279swc0kgu https://cdn.jsdelivr.net/gh/twitter/twemoji@14.0.2/assets/72x72/1f9a6.png https://cdn.jsdelivr.net/gh/twitter/twemoji@14.0.2/assets/72x72/1f9a6.png https://njump.me/nevent1qqsvnff2cawrd44yagv86axt4xh72ntv2htz32wl3qzgq9pmfawmf9czyraye780qyx8f9v3x598zdaef4qg4q0nwkqtytzdlrpa7qxzq4tckty48xk My Calendar 3.8.8: Critical Security Release<br/><br/>My Calendar 3.8.8 fixes a critical security issue that allowed an unauthenticated attacker to gain full administrative privileges on a site running My Calendar.<br/>Due to the severity of this issue, courtesy security releases have been pushed by the WordPress Plugin Team for version 3.4, 3.5, 3.6, and 3.7. The primary vectors for the vulnerability do not exist in versions prior to 3.4.<br/>The fixed versions are:<br/>My Calendar 3.4.25<br/>My Calendar 3.5.22<br/>My Calendar 3.6.18<br/>My Calendar 3.7.18<br/>My Calendar 3.8.8+<br/>It should be noted that the backported updates only fix this security issue, and fix no other bugs or security issues in those respective versions. Those releases are being provided as a courtesy; the only supported version of My Calendar is the most recent, currently version 3.8.8.<br/>My thanks to Wordfence and their responsible disclosure by researcher daroo for privately communicating this critical issue to me promptly.<br/>While I have no evidence or reports of this issue being exploited to date, you are strongly advised to check for unrecognized users or files within your system.<br/>This issue has been given the CVE record CVE-2026-104798.<br/><br/><a href="https://www.joedolson.com/2026/10/my-calendar-3-8-8-critical-security-release/">https://www.joedolson.com/2026/10/my-calendar-3-8-8-critical-security-release/</a> 2026-10-16T03:28:00Z