Wordfence says its Argus threat intelligence team uncovered two critical, unauthenticated vulnerability chains in The Events Calendar WordPress plugin, both capable of leading to remote code execution on sites running vulnerable versions. The issues affected releases up to 6.17.4 and were patched in 6.17.4.1, with Wordfence urging administrators to update immediately.
Two separate chains, one exposed attack surface
The plugin is active on more than 600,000 websites, making the findings especially significant for WordPress operators. According to Wordfence, both chains begin in the plugin’s widget-rendering pipeline and can be triggered without a login, registration, or social engineering.
They share a common condition: the target event page must have comments enabled, and The Events Calendar’s own “Show comments on event pages” option must be active. Wordfence says the attacks can be delivered through WordPress’s pending-comment preview flow, meaning an attacker can reach the vulnerable code path before any moderator approval.
How The Events Calendar exposed comment content to block processing
Wordfence’s report says the plugin’s V2 single-event template buffers the entire rendered page, including the comment section, and then passes that HTML through WordPress’s do_blocks() function. That matters because Gutenberg block markup can survive in comment text through HTML comment delimiters, allowing attacker-controlled content to be parsed as blocks.
In ordinary WordPress behavior, do_blocks() is meant for post content, not buffered page output. Wordfence says that design choice broadens the attack surface to include content submitted by anonymous commenters.
The role of the pending-comment preview
After a comment is submitted, WordPress typically provides a moderation-hash URL that lets the author preview the pending comment immediately. Wordfence says that mechanism is enough to trigger the vulnerable code before moderation occurs, which is why neither chain requires an approved comment.
Unauthenticated PHP object injection to remote code execution
The first chain is rated 9.8 critical and tracked as CVE-2026-78006. Wordfence says it affects The Events Calendar through version 6.17.4 and was patched in 6.17.4.1.
At the center of this path is a validation routine called is_safe_widget_instance(). Wordfence says the function attempts to protect against unsafe serialized widget instances, but the check can be bypassed because PHP may trigger magic methods during parsing before the function finishes evaluating the payload.
That opens the door to a PHP object injection gadget that eventually reaches custom_unserialize() in Lazy_Post_Collection. Wordfence says that method deserializes attacker-controlled data and passes values directly into array_map() without validating the callable, creating an operating-system command execution sink.
What an attacker could do
- Execute arbitrary operating system commands on the server
- Deploy malware or additional web shells
- Steal sensitive site data
- Achieve full site and server compromise
Arbitrary callable invocation and password reset
The second chain is also rated 9.8 critical and is tracked as CVE-2026-78159. Wordfence says it affects versions through 6.17.3 and was patched in 6.17.3.1.
This path bypasses the object-injection guard entirely by using a plain array payload instead of a serialized object. Wordfence says the widget instance still receives a valid integrity hash, then flows into the plugin’s template logic, where attacker-controlled array keys are extracted into local variables.
The vulnerable point appears in Element_Classes::parse_array(), which Wordfence says accepts not only closures but any value PHP considers callable. That includes named PHP functions. In the proof-of-concept described by Wordfence, the attacker can cause wp_update_user() to run with crafted arguments, resetting an administrator password and allowing full takeover.
Why this is especially dangerous
Once an attacker controls an admin account, they can upload a malicious plugin and gain the same outcome as direct remote code execution. Wordfence says the practical impact is complete loss of confidentiality, integrity, and availability for the affected site.
Vendor response and patch timeline
Wordfence says it disclosed the first vulnerability to StellarWP on August 21, 2026, and the vendor acknowledged it on August 24 before releasing an initial patch on August 25. The second vulnerability was disclosed on August 23, acknowledged on August 24, and fully patched on September 10.
Wordfence praised StellarWP’s response, describing the turnaround as fast and effective. The company also said Premium, Care, and Response customers received a firewall rule on August 22, 2026, while free users were scheduled to receive the same protection 30 days later, on September 21, 2026.
What WordPress site owners should do now
Wordfence strongly urges users of The Events Calendar to update to the latest patched release, version 6.17.4.1 at the time of publication. The advisory notes that affected sites with comments enabled on event pages are directly exposed to anonymous attackers on the internet.
For administrators, the main takeaway is simple: this is not a theoretical bug chain. Wordfence says both vulnerabilities can be triggered without authentication, and both can lead to full compromise if left unpatched.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: September 14, 2026 at 10:32 pm
0 views
