WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites
Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.
Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.
- CVE-2026-78006 and CVE-2026-78159 both rated CVSS 9.8, unauthenticated RCE.
- Over 600,000 WordPress sites run the vulnerable plugin.
- Comment-preview hash lets attackers trigger malicious blocks before moderation.
- Fully patched release is 6.17.4.1; Wordfence firewall rules shipped August 22.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-78006+1 related CVE | Unauthenticated RCE in The Events Calendar WordPress Plugin | 9.8 | 1% | PoC ×2 |
From the original article
3 min read at gbhackers.com
Two critical unauthenticated vulnerability chains in the widely used The Events Calendar WordPress plugin could allow attackers to execute code and fully compromise affected websites remotely. These flaws, identified by Wordfence Argus, impact plugin versions up to 6. 17.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.