ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “stellarwp”

4 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 3Exploit / PoC 1
SeverityAllcritical 0high 4medium 0low 0info 0

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.

Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.

SecurityWeek · 9h agoVulnerability 3 sourcesCVE-2026-78159CVE-2026-78006

Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover

Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.

Wordfence Argus discovered CVE-2026-78006 and CVE-2026-78159 (both CVSS 9.8) in StellarWP's The Events Calendar plugin, affecting over 600,000 active installations. CVE-2026-78006 exploits PHP object injection via crafted pending comments to execute OS commands; CVE-2026-78159 abuses a specially prepared array to call WordPress functions, enabling admin password resets and subsequent RCE. Both flaws are unauthenticated and patched in version 6.17.4.1, released after reports on August 21-22, 2026.

Cyber Security Newsupdated · 9h agofirst · 1d agoVulnerability 3 sourcesCVE-2026-78006CVE-2026-78159

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells; Wordfence blocked 100,000+ attempts since June 2026.

Wordfence reports active exploitation of CVE-2026-27540 (CVSS 9.8), an unauthenticated arbitrary file upload in the wwlc_file_upload_handler AJAX action of the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, 6,000+ installs), enabling remote code execution via uploaded PHP web shells. Over 100,000 exploit attempts were blocked since June 2026, including 99 in the last 24 hours, traced to ten listed IP addresses. Separately, two critical flaws (CVE-2026-78159 and CVE-2026-78006) in The Events Calendar, installed on 600,000+ sites, allow unauthenticated RCE and full site takeover via PHP object injection chains. StellarWP patched the affected plugin versions 6.17.3 and 6.17.4 in releases 6.17.3.1 and 6.17.4.1.

The Hacker Newsupdated · 6h agofirst · 15h agoExploit / PoC in the wild 6 sourcesCVE-2026-27540CVE-2026-78159CVE-2026-78006

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackersupdated · 9h agofirst · 1d agoVulnerability 3 sourcesCVE-2026-78006CVE-2026-78159