A pair of severe security flaws in The Events Calendar, a widely used WordPress plugin with over 600,000 active installs, allow attackers to hijack vulnerable sites. The vulnerabilities enable unauthenticated users to gain remote code execution, reset administrator passwords, deploy malware, or even completely compromise web servers.
What’s at Risk and Why It Matters
Security researchers from the Wordfence Threat Intelligence team uncovered these two distinct vulnerability chains in August 2026. Both exploit how the plugin renders widgets—and both can be triggered without logging in, registering an account, or requiring interaction beyond submitting specially crafted inputs. These flaws affect versions of The Events Calendar up to version 6.17.4. Administrators are urged to upgrade to version 6.17.4.1 immediately.
The first flaw, CVE-2026-78006, carries a CVSS score of 9.8. It hinges on PHP object injection, allowing execution of operating system commands on vulnerable servers. Attackers can exploit it by submitting malicious comments to event pages—assuming comments are enabled and the “Show comments on event pages” setting is active. Pending, unapproved comments can be previewed via moderation links, and due to the plugin treating event pages and comments as Gutenberg blocks, dangerous content within these comments can reach the widget-rendering layer. A malformed serialized PHP payload can slip past widget validation and execute code via vulnerable deserialization routines, posing risks like data theft or site defacement.
The second flaw—CVE-2026-78159—also scores 9.8. Rather than object injection, this issue abuses plugin safety checks using attacker-prepared arrays that eventually allow calling arbitrary PHP functions. A demonstrated impact is resetting administrator passwords. Once attacker credentials exist, full remote access can follow, including plugin uploads and code execution.
Patch Status, Mitigations, and What You Should Do
The plugin developer released a patched version (6.17.4.1) after acknowledging the reports on August 24. Both vulnerabilities were reported via Wordfence’s vulnerability portal and promptly fixed. For active defenses, Wordfence Premium, Care, and Response users were protected as of August 22, while free users will receive firewall protections by September 21.
In addition to updating the plugin immediately, site owners should review whether comments are allowed on event pages, disable that feature if possible, prune any unneeded plugins, and audit administrator accounts and server logs for any signs of compromise.
This isn’t the first time plugin vulnerabilities have caused widespread concern in the WordPress ecosystem. Add-ons that improperly sanitize input, handle serialization unsafely, or expose internal PHP methods often end up as attack vectors. Given WordPress powers a significant slice of the web, flaws of this kind ripple outward rapidly.
What to watch for: look for any unusual administrator accounts, unexpected file uploads, or suspicious activity around event comment moderation. Regular updates and proactive plugin management are fast becoming essential defenses—especially for tools as ubiquitous as The Events Calendar.
