Skip to content
Sign in
CVE-2026-780069.8CriticalCWE-502

The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution

stellarwp · The Events Calendar

Not in CISA KEV
1.5%probability of exploitation in the next 30 days
73rd percentile
050100

Higher than 73% of scored CVEs

9.8CriticalCVSS 3.1
LowCrit.

DescriptionNVD

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

Coverage3 articles · 2 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 15 Sep.

Full timeline
Quiet for 6 weekslast report 21 Sep3 articles2 outlets
15 Sep · SecurityOnline first9 Oct17 OctNow
  • Tue 15 Sep, 02:22 UTC. SecurityOnline, first report. Critical WordPress Plugin Flaws Put 600,000 Sites at Risk.
  • Wed 16 Sep, 11:57 UTC. SecurityWeek, its first report on the story. Critical WordPress Calendar Flaws Put 200,000 Sites at Risk of Takeover.
  • Mon 21 Sep, 02:59 UTC. SecurityOnline. Cisco Warns of Actively Exploited Flaws Enabling Root Access.
All coveragerunning total3SecurityOnl…2SecurityWeek115 Sep1 Oct17 OctNow
  • First report
  • Article
  • Running total
Show as table
3 articles about CVE-2026-78006 from 2 outlets
Published (UTC)OutletHeadline
15 Sep 02:22SecurityOnlineCritical WordPress Plugin Flaws Put 600,000 Sites at Risk
16 Sep 11:57SecurityWeekCritical WordPress Calendar Flaws Put 200,000 Sites at Risk of Takeover
21 Sep 02:59SecurityOnlineCisco Warns of Actively Exploited Flaws Enabling Root Access
  1. Cisco Warns of Actively Exploited Flaws Enabling Root Access
    SecurityOnline · mentions it in passing
  2. Critical WordPress Calendar Flaws Put 200,000 Sites at Risk of Takeover
    SecurityWeek · mentions it in passing
  3. Critical WordPress Plugin Flaws Put 600,000 Sites at Risk
    SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in