Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take complete control of vulnerable websites.
The flaws affect more than 600,000 active installations and can potentially lead to remote code execution, administrator password resets, malware installation, and full server compromise.
The vulnerabilities were discovered by Wordfence Argus, the Wordfence Threat Intelligence team, on August 21 and August 22, 2026. Both issues are found in the plugin’s widget-rendering process and can be exploited without requiring attackers to log in, create an account, or interact with a victim.
The Events Calendar, developed by StellarWP, is affected by two separate vulnerability chains. Website administrators are strongly advised to update the plugin to version 6.17.4.1 or later.
The first vulnerability, tracked as CVE-2026-78006, has a CVSS score of 9.8 and affects versions up to 6.17.4. It involves PHP object injection that can ultimately allow attackers to execute operating system commands on the affected server.
An attack can begin with a specially crafted comment submitted to an event page. This requires comments to be enabled for event pages and the plugin’s “Show comments on event pages” setting to be active. However, the attacker does not need the comment to be approved because WordPress allows users to preview their own pending comments through a moderation link.
The plugin processes the entire event page, including comments, as Gutenberg blocks. Researchers found that this allows malicious block content inside a pending comment to reach the plugin’s widget-rendering code.
The vulnerable code checks a widget instance before creating a trusted WordPress hash. According to researchers, a malformed serialized PHP payload can bypass this validation. The plugin attempts to prevent dangerous objects, but PHP can trigger magic methods while processing attacker-controlled data.
This can eventually result in command execution through the vulnerable deserialization process. Commands would run with the permissions of the web server user, potentially allowing an attacker to steal data, deface the website, install malware, or move further into the hosting environment.
The second vulnerability, CVE-2026-78159, also has a CVSS score of 9.8 and affects The Events Calendar versions up to 6.17.3. It follows a different attack path but can similarly lead to complete website compromise.
Rather than relying on PHP object injection, this flaw uses a specially crafted array that can pass the plugin’s security check. The attacker-controlled data is then processed by the widget template system and can reach a function capable of accepting callable PHP functions.
Researchers demonstrated that this behavior can be abused to call WordPress functions with attacker-controlled arguments. One possible result is resetting the website administrator’s password. Once an attacker gains administrator access, they could log in, upload a malicious plugin, and use it to achieve remote code execution.
StellarWP received reports of both vulnerabilities through the Wordfence Vulnerability Management Portal on August 24, 2026, and released fixes shortly afterward. Version 6.17.4.1 contains the patches for both issues.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Wordfence Premium, Care, and Response customers received firewall protection against known exploitation attempts on August 22. Free Wordfence users are scheduled to receive the same protection rule on September 21.
