CVE-2023-6360: My Calendar WordPress plugin unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with a CVSS score of 9.8 and a very high EPSS probability, plus a public exploit reference, makes this an urgent patch.

What it is

The My Calendar WordPress plugin before version 3.4.22 exposes a REST route '/my-calendar/v1/events' where the 'from' and 'to' parameters are not properly sanitized, allowing SQL injection. Because the route is reachable without authentication, any remote attacker can inject SQL into the site's database. This is a critical flaw for any WordPress site running an affected version.

Impact

An attacker can read, modify, or delete arbitrary data in the WordPress database, including user credentials and site content, and may be able to escalate to full site compromise depending on database privileges.

Attack surface

Reached over the network via the plugin's REST API endpoint '/my-calendar/v1/events' with crafted 'from' and 'to' parameters. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is 0.63141 (99.167th percentile), indicating a high likelihood of exploitation in the near term. A public exploit reference from Tenable is tagged 'Exploit', so proof-of-concept code is publicly available.

What to do

• Update the My Calendar plugin to version 3.4.22 or later immediately.
• If patching is not possible, disable or remove the plugin until it can be updated.
• Restrict access to the '/my-calendar/v1/events' REST route via a WAF or reverse proxy rule.
• Audit the WordPress database and user accounts for signs of tampering after exposure.
• Apply least-privilege database permissions to the WordPress database user.

Detection

• Monitor web server and WAF logs for requests to '/my-calendar/v1/events' containing SQL metacharacters in the 'from' or 'to' parameters.
• Enable and review WordPress database query logging for anomalous SQL patterns originating from the plugin's REST route.
• Check for unexpected changes to WordPress users, options, or content that could indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.