Cyber Resilience

CVE-2026-24523

Medium

Published: 23 January 2026

Published
23 January 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0001 3.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-24523 is a medium-severity Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) vulnerability. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Information Discovery (T1082); ranked at the 3.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement).

Deeper analysis

CVE-2026-24523 is an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability (CWE-497) in the WP FullCalendar WordPress plugin, developed by Marcus (aka @msykes) and known as wp-fullcalendar. The flaw allows retrieval of embedded sensitive data and affects all versions from n/a through 1.6 inclusive. Published on 2026-01-23, it carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low-impact confidentiality loss.

The vulnerability can be exploited by any unauthenticated attacker over the network with low complexity and no user interaction required. Exploitation enables retrieval of embedded sensitive data exposed to an unauthorized control sphere, resulting in limited disclosure of confidential system information without impacting integrity or availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-fullcalendar/vulnerability/wordpress-wp-fullcalendar-plugin-1-6-sensitive-data-exposure-vulnerability?_s_id=cve details this sensitive data exposure issue in WP FullCalendar version 1.6 and related versions.

EU & UK References

Vulnerability details

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <= 1.6.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1082 System Information Discovery Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The CVE describes unauthenticated network exposure of sensitive system information via a public-facing WordPress plugin, directly enabling System Information Discovery (T1082) and initial access via public application exploitation (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-9110Shared CWE-497
CVE-2026-24536Shared CWE-497
CVE-2025-13651Shared CWE-497
CVE-2024-52367Shared CWE-497
CVE-2020-36922Shared CWE-497
CVE-2025-9986Shared CWE-497
CVE-2025-13616Shared CWE-497
CVE-2020-36926Shared CWE-497
CVE-2024-36554Shared CWE-497
CVE-2026-24377Shared CWE-497

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces access control policies so that unauthenticated remote users cannot retrieve the embedded sensitive data exposed by the WP FullCalendar plugin.

prevent

Enforces information-flow rules that keep sensitive system data inside its authorized control sphere and block the unauthorized retrieval described in CVE-2026-24523.

prevent

Requires cryptographic or other protection of sensitive information at rest, reducing the impact if the plugin’s embedded data is stored in a publicly accessible location.

References