Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover

Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take over vulnerable websites.

The flaws affect more than 600,000 active installations. They can lead to remote code execution, administrator password resets, malware deployment, and full server compromise.

Wordfence Argus, developed by the Wordfence Threat Intelligence team, discovered the two independent vulnerability chains on August 21 and August 22, 2026.

Both issues exist in the plugin’s widget-rendering process. They can be exploited without requiring a login, account registration, or user interaction.

The affected plugin is The Events Calendar, developed by StellarWP. Website administrators are strongly advised to update to version 6.17.4.1 or later immediately.

Critical WordPress Plugin Flaws

The first issue, tracked as CVE-2026-78006, has a CVSS score of 9.8. It affects The Events Calendar versions up to 6.17.4. The vulnerability lets attackers abuse PHP object injection to execute operating system commands on the affected web server.

The attack starts when a malicious user submits a specially crafted comment to an event page. The attack only works when comments are enabled for event pages and the plugin’s “Show comments on event pages” setting is active.

However, the attacker doesn’t need an approved comment because WordPress lets comment authors preview their own pending comments through a moderation link.

The Events Calendar processes the full event page, including comments, as Gutenberg blocks. This unsafe design allows malicious block content placed inside a pending comment to reach the plugin’s widget-rendering code.

The vulnerable code validates a widget instance before generating a trusted WordPress hash for it. Researchers found that a malformed serialized PHP payload can bypass the validation. Although the plugin attempts to block dangerous objects, PHP may trigger magic methods while processing the attacker-controlled data.

This behavior can lead to command execution through a vulnerable deserialization routine. An attacker could run commands with the web server user’s permissions, potentially allowing data theft, website defacement, malware installation, or lateral movement within the hosting environment.

The second flaw, CVE-2026-78159, also carries a CVSS score of 9.8. It affects versions up to 6.17.3 and uses a separate path to gain control of the site.

Instead of using object injection, the second attack uses a specially prepared array that passes the plugin’s safety check. The attacker-controlled data is then passed into the widget template system, where it can reach a function that accepts callable PHP functions.

Researchers found that an attacker could abuse this behavior to call WordPress functions with attacker-supplied arguments. One demonstrated impact is resetting the site administrator’s password. The attacker could then sign in as an administrator, upload a malicious plugin, and obtain remote code execution.

StellarWP received the vulnerability reports through the Wordfence Vulnerability Management Portal. The vendor acknowledged both reports on August 24, 2026, and released patches shortly afterward. The fully patched release is version 6.17.4.1.

Wordfence Premium, Care, and Response customers received firewall protection for known exploit attempts on August 22, 2026. Free Wordfence users are scheduled to receive the same rule on September 21, 2026.

Site owners should update The Events Calendar immediately, review whether comments are enabled on event pages, remove unneeded plugins, and inspect administrator accounts and server logs for suspicious activity.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.