Critical Vulnerabilities Discovered in The Events Calendar Plugin for WordPress
Two significant vulnerabilities have emerged within a popular WordPress plugin, The Events Calendar, which could allow unauthenticated attackers to execute remote code (RCE) by submitting a tailored comment on an event page, as disclosed by Wordfence on Monday.
Both vulnerabilities, identified as CVE-2026-78006 and CVE-2026-78159, are rated at a rather alarming CVSS score of 9.8. These vulnerabilities were unearthed by Wordfence’s Argus AI vulnerability research tool.
The Events Calendar is extensively utilized across more than 600,000 WordPress sites, with each flaw representing a distinct pathway for potential attacks, rooted in the plugin’s handling of comments via its V2 single-event template. Exploitation is confined to public event pages where the commenting feature is enabled.
Wordfence’s findings indicated a considerable attack surface arises due to the event template processing the entire webpage through WordPress’s Gutenberg block parser, encompassing the comments section as well. This setup inadvertently fosters avenues for anonymous comments by unauthenticated users.
Related Reading:
Even with comment moderation in place, it is worth noting that users are permitted to preview their pending comments, subsequently rendering them and inadvertently triggering the attack chain.
The attack chain associated with CVE-2026-78006 allows an adversary to format a comment as a wp:legacy-widget block embedded with a malicious PHP object, facilitating arbitrary OS command execution.
Upon parsing, the malevolent comment undergoes scrutiny via The Event Calendar’s is_safe_widget_instance() method, which invokes unserialize() while assessing whether the resulting value harbors a PHP object.
If an object is absent, the plugin generates a legitimate hash for the attacker’s widget, circumventing WordPress’s integrity protocols.
Research revealed that the malicious object could indeed navigate through this method, eliciting a valid hash when the PHP magic method calls are correlated with invalid data, thereby prompting unserialize() to return “false.”
When the object subsequently infiltrates WordPress’s legacy-widget renderer with its unserialize() invocation, these magic methods are activated, executing arbitrary commands prior to the invalid data triggering a failure.
“By then, the perilous behavior has already transpired,” commented Wordfence’s Threat Intelligence Lead, Chloe Chamberland.
The proof-of-concept exploit exploits the __unserialize() magic method, invoking custom_unserialize(); this method deserializes the adversary-controlled data and directs an attacker-controllable callback and argument array into array_map().
By designating the callback as system and populating the array with a shell command, the attacker becomes empowered to execute any command with the privileges of the web server user.
The second exploit chain, associated with CVE-2026-78159, circumvents the use of a PHP object, utilizing a comment that comprises a wp:legacy-widget block embedding a plain PHP array.
This allows it to seamlessly pass through the is_safe_widget_instance() method and gain a valid hash without complications. Once deserialized by WordPress’s parser, it traverses the widget() method, merging into the widget’s arguments through array_merge().
Subsequently, the event template engine invokes extract( $this->context ), which transforms every attacker-controlled array key—including classes—into local variables within the template scope, Chamberland noted in the Wordfence blog post.
The assailant’s ensuing objective is to trigger the loading of The Events Calendar’s messages.php sub-template, resulting in the amalgamation of the attacker-controlled $classes variable with the plugin’s default CSS class list, continuously processing through its class-handling logic.
This can be achieved by forcing a “no results” response from the widget’s event query, for instance, by appending “?tribe_paged=00” to the URL.
Upon loading the messages.php sub-template, the plugin’s CSS class helper processes the attacker-controlled $classes array.
Since the helper executes any value acknowledged by PHP as callable, an attacker may submit wp_update_user as an array value, triggering an admin password reset.
The wp_update_user() function receives a results array that includes attacker-supplied values—‘ID’ => true and ‘user_pass’ => true—which WordPress interprets as instructions to alter the user ID “1” password to “1”.
This grants the attacker the capacity to log in with the newly established password, thereby seizing control of the site and facilitating code execution through the upload of a nefarious plugin.
The developer responsible for The Events Calendar plugin, StellarWP, addressed the vulnerabilities, patching CVE-2026-78006 on August 25, 2026, and rectifying CVE-2026-78159 on September 10, 2026. Wordfence advises all users of this plugin to promptly upgrade to the fully patched version 6.17.4.1.
Source link: Scworld.com.
