The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
stellarwp · The Events Calendar
Higher than 72% of scored CVEs
DescriptionNVD
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
Coverage2 articles · 2 outlets
One row per outlet, in order of first report. First in our coverage: SecurityOnline, 15 Sep.
- Tue 15 Sep, 02:22 UTC. SecurityOnline, first report. Critical WordPress Plugin Flaws Put 600,000 Sites at Risk.
- Wed 16 Sep, 11:57 UTC. SecurityWeek, its first report on the story. Critical WordPress Calendar Flaws Put 200,000 Sites at Risk of Takeover.
- First report
- Article
- Running total
Show as tableHide table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| 15 Sep 02:22 | SecurityOnline | Critical WordPress Plugin Flaws Put 600,000 Sites at Risk |
| 16 Sep 11:57 | SecurityWeek | Critical WordPress Calendar Flaws Put 200,000 Sites at Risk of Takeover |
- Critical WordPress Plugin Flaws Put 600,000 Sites at RiskSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.