CVE-2026-78159

This vulnerability is like a “back door” in a WordPress plugin: an attacker can use a special-looking message submitted in event comments to trick the website into running harmful code on the server. Even though it sounds extremely dangerous, it only works when comments are enabled on event pages and a crafted comment is involved. If successful, attackers could take control of your website and possibly your server.

This matters if you run WordPress with The Events Calendar and you have event comments enabled on tribe_events pages. The risk is highest when visitors (or anyone without server access) can submit comments that appear on event pages. This is only a risk when the issue is reachable through that comments flow (comments enabled on tribe_events, and a crafted wp:legacy-widget comment payload is present).

This is RED because the flaw can enable remote code execution on the server and does not require authentication. While the provided material does not confirm public, dated exploitation of this exact CVE, the severity is critical and the attack path can be triggered through normal website behavior (event comments). Act now to reduce exposure and upgrade once a fixed release is available.

Confirm exposure

1. Identify whether your site is using “The Events Calendar” and capture the installed version.
2. Confirm comments are enabled on tribe_events posts (and whether comments are publicly allowed).
3. Check for existing malicious content:
   • Inspect WordPress comments linked to tribe_events posts.
   • Look specifically for wp:legacy-widget blocks or other widget-like patterns inside comment text.

Remediate

1. Upgrade The Events Calendar to a fixed release. No fixed version information is available in the provided patch findings, so you will need to obtain the vendor’s patched version number from your plugin update channel or vendor/security advisory.
2. If you cannot patch immediately:
   • Disable comments on event pages (tribe_events) or switch them to strict moderation so untrusted users cannot publish crafted content.
   • Remove any existing suspicious comments that contain wp:legacy-widget blocks.

Temporary workaround guidance

• The vulnerability’s described trigger depends on the comments flow and presence of a crafted widget-style comment block. Reducing comment posting and moderation gaps breaks the trigger chain.

What to monitor

• After changes, monitor for:
  • New comments on tribe_events posts containing wp:legacy-widget or similar embedded widget markup.
  • Unexpected server-side errors or unusual outbound connections shortly after comment submissions.

CISA due date

• No KEV listing was provided, so no CISA due date is available here.

Severity is critical (Remote Code Execution), allowing arbitrary code/system command execution on the server. The mechanism described is unauthenticated RCE through a crafted comment payload that includes a wp:legacy-widget block; when the plugin processes event page blocks (including the comment area), it reaches a parsing path (Element_Classes::parse_array) where a plain-array payload can bypass a safety/object check (is_safe_widget_instance) and invoke callable behavior. Preconditions from the findings: comments must be enabled on tribe_events posts, and a crafted comment containing a wp:legacy-widget block must already exist.

Exploitation status: KEV is not listed in CISA KEV, and no public exploit code is on record in the provided findings. Press material does not give a dated claim of real-world exploitation of this exact CVE. A fixed version was not available in the provided patch findings, which means remediation must rely on obtaining the vendor’s updated release.

EPSS is reported as a prediction and is not treated as proof of exploitation; KEV/news would override such predictions, but no KEV listing was provided here.