Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells; Wordfence blocked 100,000+ attempts since June 2026.
72
Vulnerability5 · 1 read
CVE-2026-78159
Unauthenticated Remote Code Execution in The Events Calendar WordPress Plugin
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The Events Calendar plugin for WordPress, in all versions up to and including 6.17.3, insufficiently validates the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(), resulting in remote code execution. An unauthenticated attacker triggers the flaw by submitting a comment containing a crafted wp:legacy-widget block on a tribe_events post with comments enabled; the attack chain fires when do_blocks() processes the single-event HTML including the comment area. Successful exploitation gives the attacker code execution on the web server, typically enabling full site compromise. Any WordPress site running a vulnerable version of the plugin that has comments enabled on event posts is affected. No public proof-of-concept is known, the flaw is not listed in CISA KEV, and no in-the-wild exploitation has been reported.
What to do: Update The Events Calendar to the first patched release after 6.17.3 as soon as one is available. Until then, disable comments on tribe_events posts or remove/moderate any comments containing wp:legacy-widget blocks. Review event-post comments and server logs for signs of injected legacy-widget blocks or unexpected code execution.
| Product | Affected |
|---|---|
| StellarWP The Events Calendar (WordPress plugin) | all versions up to and including 6.17.3 |
Estimated exposure
mass~200,000+ sites run vulnerable versions (plugin has roughly 200k active installs); the practically exploitable subset is likely in the tens of thousands — The Events Calendar is one of the most-installed WordPress calendar plugins with on the order of 200,000 active installs on WordPress.org, though exploitation additionally requires comments to be enabled on event posts, which reduces the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
- Ecosystems
- WordPress
- Weakness
- CWE-94
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
4 storiesWordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites
Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.
68
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.
66
Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover
Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.
66