Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover
Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.
Wordfence Argus discovered CVE-2026-78006 and CVE-2026-78159 (both CVSS 9.8) in StellarWP's The Events Calendar plugin, affecting over 600,000 active installations. CVE-2026-78006 exploits PHP object injection via crafted pending comments to execute OS commands; CVE-2026-78159 abuses a specially prepared array to call WordPress functions, enabling admin password resets and subsequent RCE. Both flaws are unauthenticated and patched in version 6.17.4.1, released after reports on August 21-22, 2026.
- CVE-2026-78006 and CVE-2026-78159 both scored CVSS 9.8, exploitable without authentication
- Over 600,000 active installations of The Events Calendar affected
- First chain abuses PHP object injection via pending comment preview; second enables admin password reset
- Patch available in version 6.17.4.1; Wordfence firewall rules shipped August 22
- No confirmed in-the-wild exploitation reported
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78006+1 related CVE | Unauthenticated RCE in The Events Calendar WordPress Plugin | 9.8 | 1% | PoC ×2 |
From the original article
2 min read at cybersecuritynews.com
Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take over vulnerable websites. The flaws affect more than 600,000 active installations. They can lead to remote code execution, administrator password resets, malware deployment, and full server compromise.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.