CVE-2026-78006

The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

No known exploitation. EPSS puts it in the 73rd percentile. No fix published yet.

CVSS 3.19.8Critical EPSS percentile73rd1.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-12Updated 2026-09-14Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your WordPress site uses “The Events Calendar” version 6.17.4 or earlier.
Check whether event comments are enabled and visible on events (people can post/view comments on event pages).
If both are true, disable or restrict comments on event pages immediately (at least temporarily) to remove the attacker entry point.
Look for an official fixed update from the plugin vendor for The Events Calendar; apply it as soon as it’s available.
If you cannot update right away, keep event comments disabled and block public posting to reduce exposure until a fixed version is released and applied.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

In plain language

Written by AI from the record

The Events Calendar (up to 6.17.4) has a critical bug where anyone on the internet can post a crafted comment on an event and run harmful code on the server—this is a serious risk if you have event comments enabled.

Unauthenticated PHP Object Injection leading to Remote Code Execution exists in The Events Calendar up to and including 6.17.4; an attacker bypasses input-safety handling in a PHP path (is_safe_widget_instance) when comments are processed/rendered, enabling server-side command execution without login if event comments are enabled and reachable.

If you're affected

Full website takeover
Server compromise
Customer data exposure
Operations disruption

What is it

This is a flaw in how The Events Calendar processes event comments. If someone posts a specially crafted comment, the site can be tricked into running code on your server. Think of it like a “message box” on your event page that shouldn’t be able to do anything—except, in this case, a malicious message can make the server do attacker instructions.

Who is affected

This matters if you run WordPress with “The Events Calendar” and your event pages allow public visitors to post and view comments. Your exposure is specifically tied to whether comments are enabled and visible on events using this plugin. It’s a risk without any login if that comment feature is reachable on your live site.

How urgent is it

This is a RED issue because attackers can target your site from the internet without needing an account, by posting a crafted event comment that triggers server-side code execution. The vulnerability is reachable when comments are enabled and visible on event pages, so a typical public-facing events site is in the danger zone.

What to do — in detail

Confirm exposure
- Identify your WordPress plugin version for “The Events Calendar” and determine whether it is 6.17.4 or earlier.
- Verify whether your event pages have comments enabled and visible (i.e., visitors can post comments and then view them on the event page).
Immediate containment (if affected)
- Disable comments on event pages (or otherwise restrict public comment posting/viewing) to remove the vulnerable input path.
- If your site has any moderation workflow, ensure that unapproved comment content is not displayed on event pages to non-logged-in visitors.
Patch / update
- Our findings do not include any fixed version or patch details. Contact your plugin vendor/support or monitor the plugin’s release notes for an official fix for CVE-2026-78006.
- Once a fixed release is available, upgrade to the vendor’s stated “fixed” version for The Events Calendar and confirm the plugin is updated in production.
Verification after changes
- Re-check that comments are still disabled/restricted on event pages.
- Validate that event comment rendering no longer appears to non-authenticated users (until a patched plugin version is installed).
What to monitor
- Web server and WordPress logs for unusual comment activity (unexpectedly formatted comments) around event pages.
- Any signs of unexpected server behavior after comment submissions (for example, changes in files, unexpected outbound connections, or new admin users).

Technical context

Severity: Critical (CVSS 9.8) with very high impact across confidentiality, integrity, and availability.

Mechanism: CWE-502 (Deserialization of untrusted data). The reported path involves is_safe_widget_instance and a bypass due to PHP magic method execution during parsing, combined with enable_rendering_widget_copied() forging an integrity hash before unserialize is reached. This can result in Remote Code Execution when maliciously crafted input reaches that processing flow.

Attack vector and reachability: Network-based and unauthenticated. The findings specify that comments must be enabled and visible on events within The Events Calendar for the vulnerable code path to be reachable. The template renders blocks by processing buffered comment HTML, and the system provides a way for an unauthenticated commenter to immediately view their pending comment content on the event page (before moderation), which delivers the injected markup to the vulnerable path.

Exploitation status: Not listed in CISA KEV. No clear dated exploitation report in the provided news findings. No public exploit code on record.

Patch availability: No fix/patch information available in the provided findings.

KEV meaning: Since this CVE is not in KEV here, we do not have CISA-listed confirmation of widespread exploitation from this dataset.

EPSS: A low predicted likelihood is noted in the findings, but this should not be used to downplay risk when the attack requires only a publicly reachable comment feature and no authentication.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS73rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.5% chance of exploitation activity in the next 30 days, which ranks it in the 73rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 2 days, from the signal feeds we watch.

2026-09-14Record updated
2026-09-12Publishedweakness classified, att&ck mapped, record updated

Affected products

stellarwpcommercial
- The Events CalendarCMS PluginOn-premWeb & CMS Plugins / wordpress-plugin

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable