Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.
Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.
- CVE-2026-78159: unauthenticated code injection during single-event HTML processing
- CVE-2026-78006: unauthenticated PHP object injection via event comments
- Both chains lead to RCE and complete WordPress installation compromise
- ~240,000 sites run versions affected by both vulnerabilities
- Exploitation requires comments enabled on events
- Products
- The Events CalendarWordPress
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78006+1 related CVE | Unauthenticated RCE in The Events Calendar WordPress Plugin | 9.8 | 1% | PoC ×2 |
From the original article
2 min read at securityweek.com
Vulnerabilities in The Events Calendar can provide attackers with remote code execution capabilities. The post Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.