CVE-2026-104798 and Five More Critical WordPress Plugin CVEs (CVSS 9.8): Detection, Hunting, and Emergency Remediation Guide

NVD has published six CRITICAL, network-vector CVEs affecting WordPress plugins in the last 72 hours. This is not routine plugin churn. Three of them carry a CVSS base score of 9.8 — the ceiling for unauthenticated, low-complexity remote exploitation — and the affected plugins (My Calendar, Mang Board, MailOptin) are common on marketing sites, community portals, and small-business infrastructure that rarely gets hardened.

The most severe, CVE-2026-104798, affects the My Calendar – Accessible Event Manager plugin, all versions up to and including 3.8.7. It allows an unauthenticated attacker to gain unauthorized privileges via a reflected shortcode injection — no credentials, no user interaction, no exploit chain required. CVE-2026-109219 (Mang Board, CVSS 9.8) is an arbitrary file upload, which in a PHP application context is functionally equivalent to remote code execution: upload a .php payload into a web-accessible path and request it. CVE-2026-109515 (MailOptin, CVSS 9.8) rounds out the 9.8 cluster, alongside three additional criticals: CVE-2026-103768, CVE-2026-89079, and CVE-2026-104730.

If you operate or manage any WordPress estate — directly or as an MSSP covering client properties — treat this as an emergency patch-and-hunt event. The exploitation barrier on these bugs is trivial, and WordPress plugin CVEs of this class historically move from disclosure to mass scanning within days.

Technical Analysis

Affected Products and Identifiers

All six are network-exploitable, meaning no local access and (for the 9.8 cluster) no authentication is required.

How CVE-2026-104798 Works (Defender's View)

The vulnerability is a nested shortcode injection via a public GET parameter:

1. The plugin accepts a public mcs GET parameter.
2. The value of mcs is reflected into post content without sanitization.
3. Crucially, this happens before WordPress core's do_shortcode filter executes. The injected content is therefore interpreted as a shortcode — specifically, the disclosure describes injection of a nested [my_calendar above=... payload.
4. Because the attacker controls shortcode attributes evaluated in a privileged rendering context, this escalates to unauthorized privilege gain — in practice, attacker-controlled content or actions executed with the site's capabilities.

From a defender's perspective, the key observables are: HTTP GET requests containing mcs= where the parameter value contains shortcode syntax ([, ], my_calendar, attribute assignments). Legitimate use of mcs does not include bracketed shortcode markup — that is a high-fidelity discriminator.

How CVE-2026-109219 Works (Defender's View)

Mang Board's arbitrary file upload is the more immediately weaponizable bug. The classic exploitation pattern for WordPress upload flaws is:

1. Attacker POSTs a multipart request to the plugin's upload handler (typically under /wp-content/plugins/mangboard/ or an AJAX endpoint like /wp-admin/admin-ajax.php with a Mang Board action).
2. The handler fails to validate extension/MIME, writing an attacker-controlled file — e.g., shell.php, shell.php.jpg, or a double-extension bypass — into wp-content/uploads/ or a plugin subdirectory.
3. Attacker requests the uploaded file directly over HTTP; the PHP interpreter executes it. This is full remote code execution as the web server user (www-data, apache, or the PHP-FPM pool user).
4. Post-exploitation typically follows within minutes: webshell deployment, wp-config.php credential theft (database creds, auth keys), user creation, and outbound C2.

Exploitation Status

At the time of writing, these CVEs are freshly published in NVD (within the last 3 days). None have been confirmed in CISA KEV at publication, but the class of vulnerability — unauthenticated WordPress plugin RCE/privilege escalation with public technical detail in the NVD description itself — is among the fastest to be mass-exploited. The mcs shortcode injection mechanism is described in enough detail in the CVE record to reconstruct a working request, which dramatically shortens time-to-PoC. Assume scanning and exploitation attempts are imminent or already underway and hunt retrospectively, not just prospectively.

Detection & Response

The detections below target the concrete observables: suspicious mcs parameter values, uploads of executable content into WordPress directories, and post-exploitation behavior (PHP-FPM spawning shells, webshell writes). Web access logs must be centralized — if your WordPress fleet's Apache/Nginx logs aren't in your SIEM, fix that today.

---
title: WordPress My Calendar mcs Shortcode Injection Attempt (CVE-2026-104798)
id: 3f9a2c71-8b4d-4e6f-a1c2-9d5e7f0a1b2c
status: experimental
description: Detects HTTP GET requests to WordPress where the public mcs parameter contains shortcode syntax or my_calendar markup, indicating exploitation of CVE-2026-104798 unauthenticated shortcode injection in My Calendar plugin <= 3.8.7.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104798
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains: 'mcs='
  selection_injection:
    cs-uri-query|contains:
      - '%5Bmy_calendar'
      - '[my_calendar'
      - '%5B'
      - 'above='
  condition: selection_param and selection_injection
falsepositives:
  - Extremely rare; legitimate mcs values do not contain bracketed shortcode markup
level: critical
---
title: Executable File Written to WordPress Uploads Directory
id: 7c1e4d92-5a3b-4f8c-b2d1-6e9a0c3f5b7d
status: experimental
description: Detects creation of PHP or other executable script files inside wp-content/uploads or plugin directories, consistent with arbitrary file upload exploitation (CVE-2026-109219 Mang Board) and webshell deployment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109219
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/wp-content/uploads/'
      - '/wp-content/plugins/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
      - '.php.jpg'
      - '.php.png'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate plugin updates write PHP under /wp-content/plugins/ — correlate with WordPress admin activity and update windows; uploads directory hits are near-zero false positive
level: high
---
title: PHP-FPM or Web Server Spawning Shell Processes
id: 9b2f6a15-3d7c-4e1a-a4f8-2c6d8e0b1a3f
status: experimental
description: Detects web server or PHP-FPM worker processes spawning command shells or system utilities, a hallmark of webshell execution following WordPress plugin compromise.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109219
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/id'
      - '/whoami'
  condition: selection_parent and selection_child
falsepositives:
  - Rare backup or health-check plugins invoking system binaries — investigate rather than whitelist broadly
level: critical

// Hunt WordPress exploitation attempts in web/proxy logs ingested via CommonSecurityLog (CEF) or IIS W3C logs
// Looks for: mcs shortcode injection (CVE-2026-104798), suspicious multipart uploads to Mang Board endpoints,
// and direct requests to PHP files inside uploads directories (webshell access).
let timeframe = 7d;
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated > ago(timeframe)
    | extend Uri = coalesce(RequestURL, tostring(AdditionalExtensions))
    | extend Method = RequestMethod),
    (W3CIISLog
    | where TimeGenerated > ago(timeframe)
    | extend Uri = strcat(csUriStem, "?", csUriQuery)
    | extend Method = csMethod)
| where Uri has "wp-content" or Uri has "mcs=" or Uri has "admin-ajax.php"
| extend Suspicion = case(
    Uri has "mcs=" and (Uri has "%5B" or Uri has "[" or Uri has "my_calendar"), "CVE-2026-104798 shortcode injection",
    Uri has "mangboard" and Method =~ "POST", "Mang Board POST (possible CVE-2026-109219 upload)",
    Uri matches regex @"/wp-content/uploads/[^\s?]+\.(php|phtml|phar|php5|php7)", "Webshell access in uploads dir",
    "other")
| where Suspicion != "other"
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Attempts=count(), TargetHosts=dcount(Computer)
  by Suspicion, SourceIP, Uri, Computer
| order by Attempts desc

-- Hunt for webshells and recently modified PHP files in WordPress directories
-- Deploy across WordPress hosts; flags PHP in uploads (near-zero legit) and recent plugin dir changes.
LET uploads_glob = '/var/www/*/wp-content/uploads/**/*.php'
LET uploads_glob2 = '/srv/www/*/wp-content/uploads/**/*.php'

SELECT FullPath, Size, Mtime, Ctime,
       read_file(filename=FullPath, length=200) AS FileHeader
FROM glob(globs=[uploads_glob, uploads_glob2])
WHERE NOT FileHeader =~ '<?php /* Silence is golden'
ORDER BY Mtime DESC

#!/bin/bash
# emergency-wordpress-cve-triage.sh
# Identify vulnerable plugins, disable them, and sweep for webshell indicators.
# Run on each WordPress host. Requires wp-cli and sudo for log access.

WP_PATHS=$(find /var/www /srv/www /home -maxdepth 3 -name "wp-config.php" 2>/dev/null | xargs -r dirname)

for WP in $WP_PATHS; do
  echo "===== Checking site: $WP ====="

  # 1. Report installed versions of affected plugins
  sudo -u www-data wp --path="$WP" plugin list --format=table 2>/dev/null | \
    grep -Ei "my-calendar|mangboard|mailoptin" && \
    echo "[!] AFFECTED PLUGIN FOUND in $WP"

  # 2. Deactivate known-vulnerable plugins immediately (patch-first strategy: deactivate until updated)
  for SLUG in my-calendar mangboard mailoptin; do
    sudo -u www-data wp --path="$WP" plugin is-active "$SLUG" 2>/dev/null && {
      echo "[!] Deactivating $SLUG in $WP"
      sudo -u www-data wp --path="$WP" plugin deactivate "$SLUG"
    }
  done

  # 3. Sweep uploads for executable PHP (webshell indicator - should return ZERO results)
  echo "--- PHP files in uploads (should be empty):"
  find "$WP/wp-content/uploads" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) -mtime -30 2>/dev/null

  # 4. Hunt access logs for mcs injection attempts (CVE-2026-104798)
  echo "--- mcs injection attempts in access logs:"
  grep -E "mcs=.*(%5B|\[|my_calendar)" /var/log/apache2/access.log* /var/log/nginx/access.log* 2>/dev/null | tail -20

  # 5. Check for recently created admin users (privilege gain follow-on)
  echo "--- Administrator role users (verify all are legitimate):"
  sudo -u www-data wp --path="$WP" user list --role=administrator --fields=user_login,user_email,user_registered 2>/dev/null
done

echo "===== Triage complete. Patch plugins to fixed versions before re-activating. ====="

Remediation

Immediate (next 24 hours):

1. Patch or deactivate. Update My Calendar beyond version 3.8.7 as soon as the vendor ships a fixed release — until then, deactivate the plugin entirely; the vulnerability is exploitable with zero authentication and the workaround surface is effectively nil. Do the same for Mang Board and MailOptin: check wp-admin or wp plugin list for pending updates and apply immediately, or deactivate until fixed versions are available. Monitor the WordPress plugin repository and vendor changelogs for CVE-2026-103768, CVE-2026-89079, and CVE-2026-104730 as NVD records populate with affected product details — reconcile those against your plugin inventory the moment they publish.

2. Enforce PHP execution denial in uploads. Regardless of patch status, block PHP execution under wp-content/uploads/ at the web server layer. For Nginx, return 403 for ~* \.php$ locations under /uploads/; for Apache, drop an .htaccess with php_flag engine off and a Require all denied for script handlers. This neutralizes the entire file-upload-to-RCE class, including CVE-2026-109219 follow-on.

3. WAF virtual patching. Deploy rules blocking: (a) GET requests where mcs contains [, %5B, or my_calendar; (b) multipart POSTs to Mang Board endpoints carrying executable content types or double extensions. This buys time for sites that cannot be patched immediately.

4. Hunt retrospectively. Run the KQL query and the bash triage script above across the last 30 days of logs and filesystem state — these CVEs were published within the last 3 days, but disclosure timing and zero-day exploitation rarely align. Look specifically for: requests with injected shortcode markup, PHP files in uploads, unexpected administrator accounts, and modified wp-config.php.

Near-term (this week):

5. Rotate credentials on any host with confirmed or suspected exposure — WordPress database credentials and auth salts/keys in wp-config.php first, then any service accounts reachable from the web server context.
6. Inventory your WordPress attack surface properly. Most organizations don't know how many WordPress instances they own (marketing microsites, forgotten staging boxes, vendor-hosted landing pages). These six CVEs are an excellent forcing function for an external attack surface review.
7. Centralize web access logs into your SIEM. Every detection above depends on it. If a client's WordPress host logs only to local disk, that visibility gap is itself a finding.

Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-104798 — track the NVD records for all six CVEs as CVSS vector details and vendor fix versions are enriched over the coming days.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub