← News
/DISPATCH · 2026-09-14

CVE-2026-78006: The Events Calendar Unauthenticated PHP Object Injection, CVSS 9.8 RCE

WordPress events plugin The Events Calendar 6.17.4 and below has unauthenticated PHP object injection CVE-2026-78006, CVSS 9.8. An attacker can trigger deserialization and code execution by submitting a single comment on an event page.

On 12 September 2026, Wordfence disclosed unauthenticated remote code execution CVE-2026-78006 in the WordPress events plugin The Events Calendar. CVSS 3.1 score 9.8. Weakness type CWE-502, deserialization of untrusted data. All versions 6.17.4 and below are affected. The vendor also fixed a related issue, CVE-2026-78159. An attacker needs no account and no interaction. Submitting one comment on an event page can cause the server to execute arbitrary code. Integrity, confidentiality, and availability all fail.

Incident Overview

The Events Calendar is maintained by StellarWP and is one of the highest-installed event-management plugins in the WordPress ecosystem. Reported by Wordfence researcher Chloe Chamberland and the Wordfence Argus team. CNA is Wordfence. Concurrently published CVE-2026-78159 affects versions 6.17.3 and below—another injection path in the same plugin. The vendor hardened both in subsequent security releases.

Technical Details

The issue is in the plugin's `is_safe_widget_instance()` validation function, intended to confirm data-structure safety before processing copied legacy widget instances. Two defects make the check ineffective: first, PHP fires magic methods before full parse, so an attacker can produce side effects in the pre-parse stage; second, the plugin's `enable_rendering_widget_copied()` fabricates a complete property that passes `wp_hash()` for the data under processing, laundering malicious data before it reaches `unserialize()`.

Delivery is equally precise. The plugin V2 single-event template runs `do_blocks()` on buffered comment HTML. After WordPress receives a pending comment, it returns a link with a moderation hash, allowing an unauthenticated commenter to view the not-yet-approved comment immediately. Attackers use this to feed injected block markup into the vulnerable path, bypassing moderation entirely, provided the event page is open and comments are visible.

Impact Assessment

CVSS 9.8 maps to vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`: network-reachable, no privileges, no user interaction. Reference data shows EPSS around 0.0078. As of 12 September no complete public exploit was seen, but the description is detailed enough that comment submit, retrieve moderation link, and trigger deserialization take a few HTTP requests and can be scripted at scale. On success, an attacker can write a web shell, read database credentials and keys from `wp-config.php`, deface pages, or move laterally to other sites on the same host. For small sites with event comments enabled, this is a typical low-barrier, high-payoff target.

Remediation

References