AI analysis
The Events Calendar plugin for WordPress, in all versions up to and including 6.17.3, insufficiently validates the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(), resulting in remote code execution. An unauthenticated attacker triggers the flaw by submitting a comment containing a crafted wp:legacy-widget block on a tribe_events post with comments enabled; the attack chain fires when do_blocks() processes the single-event HTML including the comment area. Successful exploitation gives the attacker code execution on the web server, typically enabling full site compromise. Any WordPress site running a vulnerable version of the plugin that has comments enabled on event posts is affected. No public proof-of-concept is known, the flaw is not listed in CISA KEV, and no in-the-wild exploitation has been reported.
What to do: Update The Events Calendar to the first patched release after 6.17.3 as soon as one is available. Until then, disable comments on tribe_events posts or remove/moderate any comments containing wp:legacy-widget blocks. Review event-post comments and server logs for signs of injected legacy-widget blocks or unexpected code execution.
Affected
| StellarWP The Events Calendar (WordPress plugin) | all versions up to and including 6.17.3 |
Estimated exposure
mass~200,000+ sites run vulnerable versions (plugin has roughly 200k active installs); the practically exploitable subset is likely in the tens of thousands — The Events Calendar is one of the most-installed WordPress calendar plugins with on the order of 200,000 active installs on WordPress.org, though exploitation additionally requires comments to be enabled on event posts, which reduces the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.