Critical WordPress Plugin Flaws Put 600,000 Sites at Risk

The Events Calendar WordPress plugin is affected by two critical vulnerabilities that can enable unauthenticated remote code execution. CVE-2026-78006, rated 9.8, is a PHP object-injection flaw affecting versions up to and including 6.17.4, while CVE-2026-78159, also rated 9.8, allows arbitrary callable execution in versions up to and including 6.17.3. The report says the flaws affect a plugin used by more than 600,000 websites.

The attack begins when a visitor submits a specially crafted pending comment. A moderation preview renders the unapproved comment immediately, causing malicious widget block markup to be processed before a moderator reviews it. The first vulnerability can lead to shell-command execution through PHP magic methods and deserialisation. The second can invoke permitted PHP functions, potentially allowing an attacker to reset an administrator’s password and upload a malicious plugin.

The article says researchers observed CVE-2026-78006 being exploited in the wild, although its summary also contains a conflicting “no confirmed exploitation yet” status. Wordfence reportedly blocked 1,113 attacks targeting the vulnerability in the preceding 24 hours.

StellarWP fixed the issues in version 6.17.4.1, which administrators are urged to install immediately. If updating is temporarily impossible, disabling comments on event pages can prevent the described attack path, but the report says this is not a substitute for patching. Administrators should also review server access logs for unusual moderation-preview requests.