CVE-2026-78159
Received Received - Intake

Remote Code Execution in The Events Calendar WordPress Plugin

Publication date: 2026-09-12

Last updated on: 2026-09-12

Assigner: Wordfence

Description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-12
Last Modified
2026-09-12
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-78159
EUVD
EUVD-2026-76833

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
moderntribe the_events_calendar to 6.17.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Remote Code Execution vulnerability in The Events Calendar WordPress plugin affecting versions up to 6.17.3. It occurs due to insufficient validation in the parse_array function, allowing attackers to bypass security checks and execute arbitrary code on the server. Exploitation requires comments enabled on tribe_events posts and a crafted comment with a wp:legacy-widget block.

Detection Guidance

Check for the presence of the The Events Calendar plugin version 6.17.3 or lower. Inspect WordPress comments on tribe_events posts for crafted wp:legacy-widget blocks. Review server logs for unusual code execution patterns or unauthorized access attempts.

Impact Analysis

Unauthenticated attackers can execute malicious code on your server. This could lead to full system compromise, data theft, website defacement, or further network infiltration. Attackers need only submit a specially crafted comment to trigger the vulnerability when the site processes the comment block.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face fines, legal action, and reputational damage if exploited.

Mitigation Strategies

Update the The Events Calendar plugin to the latest version immediately. Disable comments on tribe_events posts if not required. Implement a web application firewall to block malicious payloads. Monitor server activity for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart