Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.
Defiant identified two critical vulnerabilities in The Events Calendar WordPress plugin, which has over 600,000 active installations. CVE-2026-78159, unauthenticated code injection during single-event HTML processing, was patched in version 6.17.3.1 on August 25; CVE-2026-78006, unauthenticated PHP object injection via event comments, was patched in 6.17.4.1 on September 10. Both independent chains lead to remote code execution and full site compromise. Roughly 240,000 sites run versions vulnerable to both flaws, and about 300,000 downloads between September 10 and 14 suggest half of installations may still lack the second fix.