The Events Calendar WordPress plugin is affected by two critical unauthenticated vulnerability chains that could allow attackers to take complete control of vulnerable websites. The flaws, tracked as CVE-2026-78006 and CVE-2026-78159, both carry a CVSS score of high and impact more than 600,000 active installations. The vulnerabilities reside in the plugin’s widget-rendering functionality and can ultimately enable remote code execution, administrator account takeover, malware deployment, website defacement, data theft, and potential compromise of the underlying server. The vulnerabilities were discovered by Researcher on August 21 and 22, 2026, and exploitation does not require authentication, account registration, or user interaction.

CVE-2026-78006 affects The Events Calendar versions up to 6.17.4 and exploits an unsafe PHP object deserialization process. An attacker can submit a specially crafted comment to an event page when comments are enabled and the plugin’s “Show comments on event pages” setting is active. Because WordPress allows users to preview their own pending comments, the attacker does not need the comment to be approved. The plugin processes event content, including comments, as Gutenberg blocks, allowing malicious content to reach the widget-rendering code. Researchers found that a malformed serialized PHP payload could bypass validation and trigger PHP magic methods during deserialization, ultimately allowing an attacker to execute operating-system commands with the privileges of the web server.

The second vulnerability, CVE-2026-78159, affects versions up to 6.17.3 and follows a separate exploitation path. Instead of relying on PHP object injection, an attacker can supply a specially crafted array that bypasses the plugin’s security validation and reaches its widget template system. The attacker-controlled data can then be used to invoke callable PHP functions with attacker-supplied arguments. One demonstrated impact is the ability to reset the WordPress administrator’s password, after which the attacker can authenticate as an administrator, upload a malicious plugin, and achieve remote code execution. This could provide attackers with persistent control of the WordPress site and potentially the underlying hosting environment.

StellarWP acknowledged both vulnerabilities on August 24, 2026, after receiving the reports through the Wordfence Vulnerability Management Portal, and released a fully patched version, The Events Calendar 6.17.4.1. Website administrators should immediately update to this version or later, review whether comments are enabled on event pages, and remove unnecessary plugins to reduce the attack surface. Administrators should also review WordPress administrator accounts, authentication activity, and server logs for suspicious password resets, newly created accounts, unexpected plugin installations, malicious files, or unusual command execution. Wordfence Premium, Care, and Response customers received firewall protection against known exploitation attempts on August 22, while free users are scheduled to receive the protection on September 21, 2026.