Flaws in The Events Calendar WordPress plugin enable unauthenticated RCE

Two critical vulnerabilities in a WordPress plugin called The Events Calendar could enable an unauthenticated attacker to achieve remote code execution (RCE) by submitting a crafted comment to an event page, Wordfence disclosed Monday.Both flaws, tracked as CVE-2026-78006 and CVE-2026-78159, have a CVSS score of 9.8 and were discovered by Wordfence’s Argus AI vulnerability research agent.The Events Calendar is a plugin used on more than 600,000 WordPress websites, and each flaw represents a separate attack path stemming from how comments are handled by the plugin’s V2 single-event template. The flaws can only be exploited on public event pages where comments are enabled.Wordfence found that the event template causes the entire rendered webpage to be passed through WordPress’ Gutenberg block parser, including the comments section, which expands the potential attack surface to include anonymous comments left by unauthenticated users. Related reading: Even when comments are held for moderation, WordPress allows a user to see the preview of their pending comment, causing it to render and trigger the attack chain.In the attack chain enabled by CVE-2026-78006, the attacker crafts a comment formatted as a wp:legacy-widget block containing a malicious PHP object that allows for arbitrary OS command execution.When the malicious comment is parsed, it goes through The Event Calendar’s is_safe_widget_instance() method, which calls unserialize() and checks if the returned value contains a PHP object. If an object is not found, the plugin issues a valid hash for the attacker’s widget, allowing it to pass WordPress’ integrity checks.Wordfence found that the malicious object could pass through this method and receive a valid hash when the object’s PHP magic method calls are followed by invalid data, causing unserialize() to return “false.” When the object later reaches WordPress’s legacy-widget renderer and its unserialize() call, these magic methods are triggered to execute arbitrary commands prior to the failure caused by the invalid data.“By then, the dangerous behavior has already occurred,” Wordfence Threat Intelligence Lead Chloe Chamberland wrote.In the proof-of-concept exploit, the __unserialize() magic method is triggered, which calls custom_unserialize(); this method deserializes the attacker-controlled data and passes an attacker-controlled callback and argument array to array_map(). By setting the callback to system and the array to contain a shell command, the attacker can execute any command as the web server user.The second exploit chain, enabled by CVE-2026-78159, avoids the use of a PHP object and instead uses a comment containing a wp:legacy-widget block with a plain PHP array. This allows it to pass through the is_safe_widget_instance() and receive a valid hash without issue. Once it is deserialized by WordPress’s parser, it passes through the widget() method and is merged into the widget’s arguments via array_merge().The event template engine later calls “extract( $this->context )”, which “turns every attacker-controlled array key, including classes, into a local variable in the template scope,” Chamberland wrote in the Wordfence blog post. The attacker’s next aim is to trigger The Event Calendar’s “messages.php” sub-template to load, which causes the attacker-controlled $classes variable to be merged with the plugin’s default CSS class list and passed into its class-processing logic. To do this, they can force a “no results” response from the widget’s event query, for example, by adding “?tribe_paged=00” to the URL.Once the messages.php sub-template loads, the plugin’s CSS class helper processes the attacker-controlled $classes array, and because the helper executes any value that PHP recognizes as callable, the attacker can supply wp_update_user as an array value to trigger an admin password reset.The wp_update_user() function is called with a results array containing the attacker supplied values of ‘ID’ => true and ‘user_pass’ => true, which WordPress processes as instructions to change the password of user ID “1” to “1”. The attacker can then log in with this new password, gaining control over the site and the ability to execute code by uploading a malicious plugin.The developer of The Events Calendar plugin, StellarWP, patched CVE-2026-78006 on Aug. 25, 2026 and fixed CVE-2026-78159 on Sept. 10, 2026. Wordfence recommends all users of the plugin to upgrade to the fully patched version, 6.17.4.1 as soon as possible. Network Security, Vulnerability Management Flaws in The Events Calendar WordPress plugin enable unauthenticated RCE (Credit: Bilal Ulker – stock.adobe.com) An In-Depth Guide to Network Security Get essential knowledge and practical strategies to fortify your network security. Related Events Get daily email updates SC Media's daily must-read of the most current and pressing daily news You can skip this ad in 5 seconds