Security Alert Summary
The Events Calendar plugin contains a remote code execution vulnerability (CVE-2026-78006) in versions up to and including 6.17.4. The issue stems from insufficient protection in the is_safe_widget_instance check combined with behavior in enable_rendering_widget_copied() and the plugin’s V2 single-event template, allowing unauthenticated commenters to deliver crafted block markup that reaches an unsafe unserialize() code path. Exploitation requires comments to be enabled and visible on events.
CVE Details
- CVE ID: CVE-2026-78006
- Affected component: The Events Calendar plugin for WordPress
- Affected versions: All versions up to and including 6.17.4
- Published: September 12, 2026 at 8:16:24 AM UTC
- Last modified: September 12, 2026 at 8:16:24 AM UTC
- CVSS v3.1: Base Score 9.8 – CRITICAL; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / Privileges / User Interaction: Authentication not required; Privileges required: none; User interaction: none
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE: CWE-502 (Deserialization of Untrusted Data)
Technical Details
The vulnerability is caused by insufficient protection in the is_safe_widget_instance check. PHP can invoke magic methods during its pre-parse process, which allows an attacker to craft input that triggers those methods. At the same time, enable_rendering_widget_copied() can forge a valid wp_hash integrity attribute before unserialize() is reached. The plugin’s V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress may return a moderation-hash URL that lets an unauthenticated commenter immediately view their own pending comment. This sequence delivers the injected block markup to the vulnerable code path before moderation occurs.
Because these conditions allow attacker-controlled serialized data to reach an unserialize() path protected insufficiently by is_safe_widget_instance, unauthenticated attackers can achieve remote code execution on the server when comments are enabled and visible on events. The description names the specific functions and templates involved: is_safe_widget_instance, enable_rendering_widget_copied(), and the V2 single-event template running do_blocks().
How This Could Impact Your Website
Consider a site owner running The Events Calendar with comments enabled on event posts. An external commenter (unauthenticated) could submit a crafted comment that includes block markup. Because WordPress may provide a moderation-hash URL allowing the commenter to view their pending comment, that markup can be rendered by the V2 single-event template and processed in the vulnerable code path. In a realistic scenario, this could allow an attacker to execute code on the web server, which may lead to data exposure or tampering consistent with the CVSS impacts.
Practical consequences may include exposure of internal user email addresses, increased risk of targeted phishing or social engineering against staff and contractors, and unauthorized changes to content or site files consistent with code execution. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Temporarily disable comments on events if you cannot immediately update and comments are not required.
- Review and reduce unnecessary user roles, especially contributor-level permissions.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from your site.
- Monitor site activity and logs for unusual behavior, unexpected file changes, or new administrative accounts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Collection_Trait.php#L247
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Collections/Lazy_Post_Collection.php#L82
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L213
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L255
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L295
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3690576%40the-events-calendar&new=3690576%40the-events-calendar
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c67346-534a-4b67-a904-fa148703707a?source=cve
