WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two critical unauthenticated vulnerability chains in the widely used The Events Calendar WordPress plugin could allow attackers to execute code and fully compromise affected websites remotely. These flaws, identified by Wordfence Argus, impact plugin versions up to 6.17.4 and have been patched in version 6.17.4.1.

The Events Calendar is active on over 600,000 WordPress websites, making these vulnerabilities a significant risk for organizations that use the plugin for publishing event schedules, registrations, and community content.

Successful exploitation can enable malware deployment, sensitive data theft, administrator account takeover, and complete control of the affected server.

Two Critical RCE Chains

The issues are tracked as CVE-2026-78006 and CVE-2026-78159, both carrying a CVSS severity score of 9.8 out of 10.

CVE-2026-78006 affects The Events Calendar versions up to 6.17.4, enabling unauthenticated PHP Object Injection that leads to remote code execution.

This flaw exists in the plugin’s `is_safe_widget_instance()` validation routine, which attempts to prevent unsafe object deserialization.

However, Wordfence researchers found that PHP magic methods, including `__unserialize()` and `__wakeup()`, can be executed. At the same time, PHP parses serialized input before the validation routine processes its result.

Attackers can use a malformed serialized payload to bypass this safety check while still triggering risky deserialization later in the execution flow.

The resulting gadget chain connects to the plugin’s `Lazy_Post_Collection` class, where attacker-controlled values can be used in PHP’s `array_map()` function.

By supplying an operating system command through a callable like `system`, an attacker could execute commands with the web server process’s permissions.

CVE-2026-78159, the second flaw, affects versions up to 6.17.3. This vulnerability uses a separate arbitrary callable execution path that does not require serialized PHP objects. Instead, an attacker can provide a crafted array that passes the object safety check and reaches the plugin’s CSS class handling logic.

Both vulnerabilities originate from the plugin’s event page rendering workflow. The Events Calendar buffers the entire single-event page, including the comments section.

Then it passes the output to WordPress’s `do_blocks()` function. Normally, WordPress processes Gutenberg blocks found in post content, not in visitor comments. However, the plugin’s use of `do_blocks()` over the rendered page allows attacker-controlled Gutenberg-style markup embedded in comments to reach the block parser.

WordPress comment sanitization retains HTML comment delimiters, which Gutenberg uses for block markup. An unauthenticated attacker can therefore submit a malicious `wp:legacy-widget` block through an event-page comment.

Crucially, exploitation does not require comment approval. WordPress gives commenters a moderation hash URL that lets them preview their own pending comments. An attacker can use this preview mechanism to activate the malicious block before a moderator reviews it.

This attack requires comments to be enabled on event pages, along with The Events Calendar’s setting to “Show comments on event pages.”

The second vulnerability exploits the plugin’s `Element_Classes::parse_array()` function. This code is intended to support dynamically generated CSS classes; however, its use of PHP’s `is_callable()` accepts globally available function names instead of restricting execution to safe closures.

An attacker can inject controlled parameters and invoke `wp_update_user()` inside WordPress, which can reset the password for the administrator user ID 1 without a capability check. After logging in as the administrator, the attacker could upload a malicious plugin and gain remote code execution.

Wordfence disclosed the vulnerabilities to StellarWP in August 2026. The vendor acknowledged the reports on August 24 and released patches; version 6.17.4.1 is the fully patched release.

Administrators should immediately update The Events Calendar to version 6.17.4.1 or later. Additionally, sites should disable comments on event pages if they are unnecessary, review administrator accounts and installed plugins for unauthorized changes, and inspect server logs for suspicious comment submissions and moderation-preview requests.

Wordfence Premium, Care, and Response customers received firewall protection on August 22, while free Wordfence users are scheduled to receive the protective rule on September 21.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.