The Events Calendar Plugin Vulnerability (CVE-2026-78159)

Security Alert Summary

The Events Calendar plugin for WordPress contains a remote code execution vulnerability (CVE-2026-78159) in the parse_array logic that can be triggered by crafted widget data. An unauthenticated attacker can exploit this issue if the site allows comments on tribe_events posts and at least one crafted comment with a wp:legacy-widget block is present, resulting in code execution when the comment is processed.

CVE Details

• CVE ID: CVE-2026-78159
• Affected component: The Events Calendar plugin for WordPress
• Affected versions: All versions up to and including 6.17.3
• Published: September 12, 2026 at 8:16:24 AM
• Last modified: September 12, 2026 at 8:16:24 AM
• CVSS v3.1: Base Score 9.8 – CRITICAL; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Authentication/Privileges/User Interaction: No privileges required (PR:N); no user interaction required (UI:N); unauthenticated network attack (AV:N)
• Primary impact: Confidentiality: High; Integrity: High; Availability: High
• CWE: CWE-94 (Improper Control of Generation of Code)

Technical Details

The vulnerability exists in the plugin’s handling of widget class data via the parse_array functionality. Insufficient validation of the widget ‘classes’ map allows a plain-array payload to bypass the is_safe_widget_instance() object check and reach a callable-invocation sink inside Element_Classes::parse_array(). When a crafted payload reaches that sink, it can result in remote code execution.

Exploitation requires two site conditions present in the supplied data: comments must be enabled for tribe_events posts, and at least one comment containing a crafted wp:legacy-widget block must have been submitted. The attack chain is triggered when do_blocks() processes the single-event HTML that includes the comment area, allowing the crafted block to be interpreted and the vulnerable code path to be reached.

How This Could Impact Your Website

On a multi-user WordPress site, this vulnerability could affect the site owner, internal staff, and external contributors. For example, an attacker who successfully exploits the vulnerability could execute code on the server, which may expose internal user data such as email addresses and other sensitive content. That exposure increases the risk of targeted phishing or social engineering against staff or contractors, and could disrupt site functionality or integrity in ways aligned with the CVSS impact ratings.

If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

• Update the affected plugin as soon as a patched version is available.
• Temporarily disable comments on tribe_events posts if you cannot immediately update and if comments are not required.
• Review and reduce unnecessary user roles, especially contributor-level accounts.
• Enforce strong passwords and two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins and regularly audit installed extensions.
• Monitor site activity and logs for unusual behavior related to comments, block parsing, or unexpected code execution.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendar
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve