CVE-2026-78006
Received Received - Intake

Remote Code Execution in The Events Calendar WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: Wordfence

Description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-78006
EUVD
EUVD-2026-76832

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the_events_calendar the_events_calendar to 6.17.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution flaw in The Events Calendar WordPress plugin versions up to 6.17.4. It occurs due to insufficient protection in the is_safe_widget_instance function, allowing bypass via PHP magic methods during pre-parse. Attackers can exploit this by forging a valid wp_hash integrity attribute before unserialize() is reached, enabling unauthenticated code execution on the server.

Detection Guidance

Check if The Events Calendar plugin is installed and its version. If it is version 6.17.4 or lower, the system is vulnerable. Look for unauthorized code execution attempts or unusual server activity.

Impact Analysis

An attacker could execute arbitrary code on your server without authentication or approval. This requires comments to be enabled and visible on events. The attack delivers malicious block markup via a pending comment before moderation occurs, potentially leading to full system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or data exfiltration, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties, fines, or reputational damage due to compromised personal or health information.

Mitigation Strategies

Update The Events Calendar plugin to the latest version immediately. Disable comments on events if not required. Monitor server logs for suspicious activity and consider temporary removal of the plugin if an update is not available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart