Network Security , Vulnerability Management Flaws in The Events Calendar WordPress plugin enable unauthenticated RCE September 17, 2026 Share By Laura French (Credit: Bilal Ulker – stock.adobe.com) Two critical vulnerabilities in a WordPress plugin called The Events Calendar could enable an unauthenticated attacker to achieve remote code execution (RCE) by submitting a crafted comment to an event page, Wordfence disclosed Monday. Both flaws, tracked as CVE-2026-78006 and CVE-2026-78159 , have a CVSS score of 9.8 and were discovered by Wordfence’s Argus AI vulnerability research agent. The Events Calendar is a plugin used on more than 600,000 WordPress websites, and each flaw represents a separate attack path stemming from how comments are handled by the plugin’s V2 single-event template. The flaws can only be exploited on public event pages where comments are enabled. Wordfence found that the event template causes the entire rendered webpage to be passed through WordPress’ Gutenberg block parser, including the comments section, which expands the potential attack surface to include anonymous comments left by unauthenticated users. Related reading: Critical vulnerability in Elementor Pro allows unauthenticated file upload and RCE WordPress plugin Gravity SMTP exploited for sensitive information disclosure WordPress Funnel Builder vulnerability exploited to steal payment data Even when comments are held for moderation, WordPress allows a user to see the preview of their pending comment, causing it to render and trigger the attack chain. In the attack chain enabled by CVE-2026-78006, the attacker crafts a comment formatted as a wp:legacy-widget block containing a malicious PHP object that allows for arbitrary OS command execution. When the malicious comment is parsed, it goes through The Event Calendar’s is_safe_widget_instance() method, which calls unserialize() and checks if the returned value contains a PHP object. If an object is not found, the plugin issues a valid hash for the attacker’s widget, allowing it to pass WordPress’ integrity checks. Wordfence found that the malicious object could pass through this method and receive a valid hash when the object’s PHP magic method calls are followed by invalid data, causing unserialize() to return “false.” When the object later reaches WordPress’s legacy-widget renderer and its unserialize() call, these magic methods are triggered to execute arbitrary commands prior to the failure caused by the invalid data. “By then, the dangerous behavior has already occurred,” Wordfence Threat Intelligence Lead Chloe Chamberland wrote. In the proof-of-concept exploit, the __unserialize() magic method is triggered, which calls custom_unserialize(); this method deserializes the attacker-controlled data and passes an attacker-controlled callback and argument array to array_map(). By setting the callback to system and the array to contain a shell command, the attacker can execute any command as the web server user. The second exploit chain, enabled by CVE-2026-78159, avoids the use of a PHP object and instead uses a comment containing a wp:legacy-widget block with a plain PHP array. This allows it to pass through the is_safe_widget_instance() and receive a valid hash without issue. Once it is deserialized by WordPress’s parser, it passes through the widget() method and is merged into the widget’s arguments via array_merge(). The event template engine later calls “extract( $this->context )”, which “turns every attacker-controlled array key, including classes, into a local variable in the template scope,” Chamberland wrote in the Wordfence blog post. The attacker’s next aim is to trigger The Event Calendar’s “messages.php” sub-template to load, which causes the attacker-controlled $classes variable to be merged with the plugin’s default CSS class list and passed into its class-processing logic. To do this, they can force a “no results” response from the widget’s event query, for example, by adding “?tribe_paged=00” to the URL. Once the messages.php sub-template loads, the plugin’s CSS class helper processes the attacker-controlled $classes array, and because the helper executes any value that PHP recognizes as callable, the attacker can supply wp_update_user as an array value to trigger an admin password reset. The wp_update_user() function is called with a results array containing the attacker supplied values of ‘ID’ => true and ‘user_pass’ => true, which WordPress processes as instructions to change the password of user ID “1” to “1”. The attacker can then log in with this new password, gaining control over the site and the ability to execute code by uploading a malicious plugin. The developer of The Events Calendar plugin, StellarWP, patched CVE-2026-78006 on Aug. 25, 2026 and fixed CVE-2026-78159 on Sept. 10, 2026. Wordfence recommends all users of the plugin to upgrade to the fully patched version, 6.17.4.1 as soon as possible. An In-Depth Guide to Network Security Get essential knowledge and practical strategies to fortify your network security. Learn More Laura French Laura French has been a staff reporter for SC Media since 2023. Laura writes daily news stories, contributes to feature stories, covers industry events and edits briefs for the SC Media website. A New Jersey native, Laura graduated from Ramapo College in 2016 and has previously written for Labcompare, FireRescue1, EMS1 and Forensic Magazine. Related Network Security Cloudflare adds post-quantum DNSSEC validation to 1.1.1.1 SC Staff September 14, 2026 Cloudflare is now validating signatures created with ML-DSA-44, a post-quantum algorithm standardized by NIST. Network Security Web DDoS attacks more than double in 1st half of 2026, Radware report finds SC Staff September 9, 2026 The Radware H1 2026 Global Threat Analysis Report indicates a significant shift in attack methods, with direct-path volumetric floods, particularly stateless UDP floods, now comprising 73% of mitigated packets. Network Security F5 BIG-IP malware hides web shells in memory to evade detection Steve Zurier September 9, 2026 Memory-resident malware targeting F5 BIG-IP appliances can evade file-based security defenses. Related Events Cybercast Network security: Adaptive defense, SASE, and micro-segmentation Tue Oct 13 Cybercast How to transform your SOC through XDR and MDR On-Demand Event Cybercast AI for network security: Problems and solutions On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms ACK Piggybacking Bastion Host Broadcast Address Circuit Switched Network Collision Computer Network Crossover Cable Decapsulation Disassembly Dynamic Routing Protocol You can skip this ad in 5 seconds