Story · 2 sources · 2 articlesfirst Sep 15, 10:01 UTCupdated Sep 15, 11:24 UTC (10h ago)

Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover

highVulnerabilityimportance 68CVE-2026-78006 CVE-2026-78159

What's new: Initial merged summary: combined two reports (Cyber Security News, GBHackers) published 2026-09-15 covering the same disclosure. Sources agree on CVE identifiers, CVSS scores, affected installation count, and patch version; GBHackers adds technical detail on the Lazy_Post_Collection gadget chain, Element_Classes::parse_array(), and the comment-preview-hash attack vector.

Merged summary · glm-5.3 · rewritten as coverage arrives

Two unauthenticated CVSS 9.8 flaws (CVE-2026-78006, CVE-2026-78159) in StellarWP's The Events Calendar plugin expose 600,000+ sites to remote code execution and admin takeover; patched in version 6.17.4.1.

Wordfence Argus disclosed two critical, unauthenticated vulnerability chains in StellarWP's The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS and affecting over 600,000 active installations. CVE-2026-78006 enables PHP object injection — described by GBHackers as a Lazy_Post_Collection gadget chain — via crafted pending comments, allowing execution of OS commands. CVE-2026-78159 abuses a specially prepared array (via Element_Classes::parse_array(), per GBHackers) to invoke WordPress functions such as wp_update_user(), enabling admin password resets and subsequent RCE. GBHackers reports exploitation involves injecting wp:legacy-widget Gutenberg markup through comments, with WordPress's moderation-preview hash triggering the malicious block before comment approval. Both flaws were reported to the vendor on August 21-22, 2026, and patched in version 6.17.4.1; Wordfence firewall rules shipped August 22. No confirmed in-the-wild exploitation has been reported.

CVE-2026-78006 and CVE-2026-78159 both rated CVSS 9.8 and exploitable without authentication
Over 600,000 active installations of The Events Calendar affected
First chain (CVE-2026-78006) is PHP object injection via pending comment preview leading to OS command execution; second chain (CVE-2026-78159) enables admin password reset and subsequent RCE
Exploitation can trigger malicious Gutenberg blocks before comment moderation via WordPress's moderation-preview hash (per GBHackers)
Fully patched release is version 6.17.4.1; vulnerabilities reported to vendor August 21-22, 2026
Wordfence firewall rules shipped August 22, 2026
No confirmed in-the-wild exploitation reported (per Cyber Security News)

Coverage timelineoldest first · each row is one article

10:01 UTC · 12h ago
Cyber Security News· 66
Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover
Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.
11:24 UTC · 10h ago
GBHackers· 68
WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites
Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-78006 +1 in the same advisory: …78159	Unauthenticated RCE in The Events Calendar WordPress Plugin The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed. Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.	9.8	<1%	PoC ×2	StellarWP (The Events Calendar) The Events Calendar WordPress plugin All versions up to and including 6.17.4	mass≈200,000+ sites (plugin reports 200,000+ active installs on WordPress.org), with the exploitable subset smaller because comments must be enabled and visible on…	3d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-78006

+1 in the same advisory: …78159

Unauthenticated RCE in The Events Calendar WordPress Plugin

The Events Calendar WordPress plugin is vulnerable to unauthenticated remote code execution (CWE-502, unsafe deserialization) in all versions up to and including 6.17.4 via the is_safe_widget_instance function, whose protection can be bypassed because PHP fires magic methods during pre-parse while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached. The flaw is reachable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own still-pending comment, delivering attacker-injected block markup to the vulnerable code path before moderation occurs. Successful exploitation gives an unauthenticated attacker arbitrary code execution on the web server with full confidentiality, integrity, and availability impact. Any site running a vulnerable version is affected, but only when comments are enabled and visible on events. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been confirmed.

Do: Update The Events Calendar to the latest available release (any version newer than 6.17.4) as soon as possible. Until patched, disable comments on events or prevent them from being publicly visible, since exploitation requires comments to be enabled and viewable on event pages. Review logs for pending comments submitted to events and unexpected widget/serialized data, and treat comment moderation queues on event posts with suspicion.

9.8

<1%

PoC ×2

StellarWP (The Events Calendar) The Events Calendar WordPress plugin All versions up to and including 6.17.4

mass≈200,000+ sites (plugin reports 200,000+ active installs on WordPress.org), with the exploitable subset smaller because comments must be enabled and visible on…

3d ago