CVE-2026-78006
CRITICAL · 9.8 EPSS 0.8%Public PoC confirmed, active threat feed chatter, urgent defender guidance, but no KEV or confirmed in-the-wild hits yet.
What: The Events Calendar WordPress plugin (≤6.17.4) is vulnerable to unauthenticated remote code execution via PHP object injection in the is_safe_widget_instance function, with CVSS 9.8.
Why it matters: Published 2026-09-12, this CRITICAL vulnerability has a public exploit circulating within 24 hours. The attack chain bypasses authentication via comment moderation mechanics, requiring only that event comments be enabled. No KEV listing yet, but immediate patching signal is strong across threat feeds and defender alerts.
Where it's seen: Threat intelligence platforms (VulnSea, Patchstack, OffSeq) reporting public PoC same day; widespread social amplification across security networks flagging WordPress site operators to disable event comments pending patches.
RISK: CRITICAL — CVSS 9.8, unauthenticated RCE, public PoC, WordPress plugin affecting thousands of sites.
Description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weaknesses
References
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Collection_Trait.php#L247
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Collections/Lazy_Post_Collection.php#L82
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L213
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L255
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L295
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3690576%40the-events-calendar&new=3690576%40the-events-calendar
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c67346-534a-4b67-a904-fa148703707a?source=cve