Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Two critical vulnerabilities in the popular WordPress plugin, The Events Calendar, could expose up to 240,000 WordPress websites to takeover attacks. Attackers can exploit these flaws to execute code remotely, potentially gaining full control of affected sites. The vulnerabilities have been patched, but a significant number of installations remain vulnerable due to the need for comments to be enabled.
Two critical vulnerabilities in the The Events Calendar WordPress plugin are exposing a large number of websites to potential takeover attacks. The plugin, with over 600,000 active installations, allows users to manage event calendars, but versions prior to 6.17.3.1 are affected by two code injection bugs. The first vulnerability, tracked as CVE-2026-78159 (CVSS score of 9.8), stems from insufficient validation and allows an attacker to inject a plain-array payload, bypassing checks and executing code during single-event HTML processing, including the comment area. The second vulnerability, CVE-2026-78006 (CVSS score of 9.8), is a PHP object injection issue exploitable if comments on events are enabled and visible. This occurs because insufficient protections in a plugin function can be bypassed by a commenter without authentication or approval, delivering injected code before moderation. StellarWP released version 6.17.3.1 on August 25 to address the first vulnerability and version 6.17.4.1 on September 10 to fix the second. Approximately 240,000 websites are currently using The Events Calendar versions prior to 6.17, and the plugin was downloaded over 300,000 times between September 10 and 14, suggesting that roughly half of its installations remain vulnerable. The vulnerabilities require that comments are enabled in the plugin for exploitation.