The Events Calendar Vulnerability Exploited in the Wild

Executive Summary

Attackers are actively targeting two critical vulnerabilities in The Events Calendar to achieve remote code execution without authentication. The security flaws allow unauthenticated visitors to inject malicious objects or trigger arbitrary callable functions through pending comments. Administrators should upgrade to version 6.17.4.1 immediately to protect their websites.

Why This Threat Matters

Sourced estimates show that more than 600,000 active websites rely on The Events Calendar to organize public events. Therefore, vulnerabilities within this core component present widespread risks to the WordPress ecosystem. If an attacker exploits The Events Calendar vulnerability, they can gain complete control over the underlying web server. Intruders can deploy backdoors, extract sensitive customer databases, and deface enterprise websites. Furthermore, successful exploitation requires no user login, account registration, or administrative approval. The attack occurs in the background before any moderator reviews the submitted comment. Wordfence confirmed immediate risk, noting that “Wordfence blocked 1,113 attacks targeting this vulnerability in the past 24 hours.”

How the Attacks Work

Both attack chains exploit a shared design defect inside the plugin’s widget rendering pipeline. The plugin buffers single-event page output and passes that content through the WordPress block parser. The advisory explains, “WordPress core does not run do_blocks() over comment text; it processes blocks in post content.” By parsing comments as blocks, the software exposes internal widget handlers to untrusted visitor input.

An attacker submits a pending comment containing crafted widget block markup. WordPress redirects the commenter to a moderation preview URL. This preview renders the unapproved comment immediately. Consequently, the injected block runs before any moderator sees the message. Furthermore, the plugin creates a valid integrity hash for the incoming data, bypassing core security checks. From this shared point, the attacks split into two distinct execution paths.

PHP Object Injection

The first chain, tracked as CVE-2026-78006, exploits a flaw in the instance safety check. The advisory warns that protection fails “because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached.”

The attacker appends malformed data after a serialized object. While the preliminary check returns false, PHP still executes the object’s magic methods. The gadget then passes attacker-controlled commands directly into a system execution sink. This allows remote actors to run arbitrary shell commands on the server.

Arbitrary Callable Execution

The second chain, tracked as CVE-2026-78159, bypasses object checks by submitting a plain array. Because the array contains no objects, the validation routine marks it safe. The template engine then extracts the array keys into local template variables.

The application passes these variables to a class parsing utility. The advisory states that “the critical flaw is that its callable check is not restricted to closures.” It invokes any valid PHP function matching the supplied parameter. Attackers can call internal user update functions to reset the administrator password. Once attackers control the administrative account, they upload malicious plugins to compromise the host.

Affected Versions

These vulnerabilities impact multiple releases of The Events Calendar plugin. Specifically, CVE-2026-78006 affects all versions up to and including 6.17.4. Meanwhile, CVE-2026-78159 affects all versions up to and including 6.17.3. Researchers observed active exploitation in the wild for the object injection flaw. In addition, detailed proof-of-concept mechanics have been publicly documented. Both flaws carry a critical CVSS base score of 9.8.

Patch and Mitigation Steps

Administrators must update their websites immediately to eliminate both vulnerability chains. StellarWP resolved these security flaws by releasing version 6.17.4.1. The firm advises, “We strongly urge users to update The Events Calendar to the latest patched version, version 6.17.4.1 at the time of publication, as soon as possible.”

If immediate patching is impossible, administrators should disable comments on event pages. Disabling the setting prevents untrusted visitors from triggering the block parser. However, temporary settings do not replace security patches. Teams should also inspect server access logs for unusual moderation preview requests.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.