Severe Vulnerability Chains Discovered in The Events Calendar Plugin for WordPress
Two alarming unauthenticated vulnerability chains within the ubiquitous The Events Calendar plugin for WordPress expose vast numbers of sites to potential remote code execution (RCE).
These vulnerabilities, delineated by Wordfence Argus, are present in versions of the plugin up to 6.17.4 and were subsequently rectified in version 6.17.4.1.
With over 600,000 instances deployed across various WordPress websites, these vulnerabilities pose a critical risk to any organization utilizing the plugin for managing event schedules, registrations, and diverse community content.
Exploiting these vulnerabilities could facilitate the deployment of malware, unauthorized access to sensitive data, takeover of administrative accounts, and comprehensive control over the compromised server.
Two Critical RCE Chains Identified
The vulnerabilities are cataloged as CVE-2026-78006 and CVE-2026-78159, both assigned a CVSS severity score of 9.8 on a scale of 10.
CVE-2026-78006 impacts versions of The Events Calendar up to 6.17.4, enabling unauthenticated PHP Object Injection that culminates in remote code execution.
This vulnerability arises from the plugin’s `is_safe_widget_instance()` validation routine, which is intended to guard against unsafe object deserialization.
However, researchers at Wordfence discovered that PHP magic methods such as `__unserialize()` and `__wakeup()` can be exploited, as PHP processes serialized input prior to the validation routine’s execution.
Malicious actors can leverage a malformed serialized payload to circumvent this safety mechanism, thus inciting precarious deserialization later in the execution sequence.
The ensuing gadget chain interfaces with the plugin’s `Lazy_Post_Collection` class, wherein user-controlled values can be manipulated within PHP’s `array_map()` function.
By providing an operating system command through a callable such as `system`, an attacker could execute commands with the privileges of the web server process.
The second vulnerability, CVE-2026-78159, pertains to versions up to 6.17.3, leveraging a distinctly separate arbitrary callable execution pathway that does not necessitate serialized PHP objects.
Instead, the attacker can offer a carefully crafted array that bypasses the object safety check, directly engaging the plugin’s CSS class management logic.
Both of these vulnerabilities find their roots in the event page rendering workflow of The Events Calendar. The plugin buffers the entirety of the single-event page, inclusive of the comments section.
Subsequently, it relays this output to WordPress’s `do_blocks()` function. Typically, this function processes Gutenberg blocks located in post content rather than in visitor comments.
Nonetheless, by employing `do_blocks()` over the rendered page, Gutenberg-style markup manipulated by attackers embedded in comments can access the block parser.
Moreover, WordPress comment sanitization retains HTML comment delimiters that Gutenberg utilizes for block markup. Hence, an unauthenticated attacker can execute a harmful `wp:legacy-widget` block through comments on the event page.
Significantly, exploitation does not rely on comment moderation. WordPress supplies commenters with a moderation hash URL that permits the preview of their pending comments.
This allows an assailant to utilize the preview feature to activate the malicious block before it undergoes moderator scrutiny.
This attack necessitates that comments be enabled on event pages, along with the configuration of The Events Calendar to “Show comments on event pages.”
The second vulnerability exploits the plugin’s `Element_Classes::parse_array()` function, which supports dynamically generated CSS classes.
However, its implementation of PHP’s `is_callable()` permits globally accessible function names, lacking restrictions to safe closures.
An attacker can inject controlled parameters to invoke `wp_update_user()` within WordPress that can reset the password for administrator user ID 1 without undergoing capability verification.
Once logged in as the administrator, the assailant could upload a nefarious plugin, thereby achieving remote code execution.
Wordfence reported these security vulnerabilities to StellarWP in August 2026. The vendor acknowledged the reports on August 24 and subsequently released patches, culminating in version 6.17.4.1 as the fully updated release.
It is imperative for administrators to promptly update The Events Calendar to version 6.17.4.1 or above.
Furthermore, it is advisable to disable comments on event pages if they are not essential, review administrator accounts and installed plugins for any unauthorized alterations, and scrutinize server logs for suspicious comment submissions and moderation-preview inquiries.
Source link: Gbhackers.com.
