Press play to start listening
Wordfence Threat Intelligence has uncovered two critical RCE chains in The Events Calendar, a WordPress plugin installed on more than 600,000 websites.
The research, led by Chloe Chamberland and the Wordfence Argus team and shared with Hackread.com, found that an attacker could use the flaws to run commands on a server or change an administrator’s password and take over the site. Both vulnerabilities have a CVSS score of 9.8 and involve the plugin’s widget-rendering pipeline.
The Events Calendar sends rendered event-page content through WordPress’s do_blocks() function, including the comments section. That means a malicious Gutenberg block placed in a comment can reach the plugin’s widget-processing code.
How the Attack Works
An attacker does not need a WordPress account. The attack requires comments to be enabled on event pages and The Events Calendar’s “Show comments on event pages” option to be active. Attackers can submit a crafted wp:legacy-widget block through a comment on an event page, allowing malicious widget data to reach the plugin’s processing code.
Researchers noted in the blog post that the two chains are independent but rely on the same flaws in how the plugin handles widget data. The plugin then generates a valid security hash for the modified widget data, allowing it to pass the check and reach one of two vulnerable paths.
- CVE-2026-78006 (PHP Object Injection): This flaw affects versions through 6.17.4 and allows a specially crafted serialized payload to get around the plugin’s object check. PHP can run magic methods inside the payload before detecting that part of the data is malformed. That can lead to attacker-controlled code being executed on the server.
- CVE-2026-78159 (Arbitrary PHP Callable Invocation): It impacts versions through 6.17.3 and uses a plain array to get around the same check. The attacker can supply a PHP function for the plugin to call, including
wp_update_user. That can be used to change the administrator’s password, after which the attacker can log in and upload a malicious plugin, leading to RCE.
Patches and Protection
Wordfence reported the first flaw to StellarWP, the company behind The Events Calendar, on August 21, 2026, and the second on August 23.StellarWP released version 6.17.3.1 on August 26 that hardened validation of copied widget instances. Additionally, Version 6.17.4.1 followed on September 10 with further security hardening and fixes the vulnerability affecting versions through 6.17.4.
Wordfence Premium, Care, and Response users received firewall protection on August 22, while free users are scheduled to receive the rule on September 21. Administrators using The Events Calendar should update to version 6.17.4.1 or later.
Expert’s Comment
Dan Moore, Sr. Director of CIAM Strategy at FusionAuth, told Hackread.com that the flaws demonstrate the risks of allowing attacker-controlled input to reach privileged functions.
“The WordPress Events Calendar RCE vulnerabilities both allow arbitrary commands through specially crafted payloads. This allows attackers to access elevated privileges, either directly against the filesystem or through WP admin commands. This is, to put it technically, bad. In one case, they were able to reset admin passwords by calling WordPress functions with elevated privileges. Resetting account credentials, especially of admin users, should require proper authentication and authorization to prevent this kind of account takeover.”
