Remote Code Execution in The Events Calendar WordPress Plugin

The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution (CVE-2026-78006) in all versions up to and including 6.17.4. The vulnerability stems from insufficient protection within the is_safe_widget_instance function, which can be bypassed because PHP executes magic methods during pre-parsing. When combined with enable_rendering_widget_copied(), an attacker can forge a valid wp_hash integrity attribute prior to reaching an unserialize() call.

The flaw is reachable by unauthenticated attackers because the plugin's V2 single-event template executes do_blocks() on buffered comment HTML. WordPress provides a moderation-hash URL that allows an unauthenticated user to view their own pending comment immediately. An attacker can leverage this to deliver malicious block markup to the vulnerable code path before any administrative moderation occurs. This attack requires the target WordPress instance to have comments enabled and visible on event pages. Successful exploitation allows for unauthenticated code execution on the underlying web server.

Attack Chain

1. Attacker identifies a WordPress instance running a vulnerable version of The Events Calendar with comment functionality enabled on event pages.
2. Attacker crafts a malicious payload disguised as block markup intended to trigger the deserialization flaw.
3. Attacker submits a new comment on an event page containing the malicious payload.
4. Attacker utilizes the WordPress moderation-hash URL to access and trigger the rendering of their own pending comment.
5. The plugin's V2 single-event template calls do_blocks() on the buffered comment HTML during the rendering process.
6. The is_safe_widget_instance function is invoked, and the attacker-forged wp_hash attribute bypasses existing integrity checks.
7. The application reaches the unserialize() function with the attacker-controlled input, leading to arbitrary code execution.

Impact

Successful exploitation of CVE-2026-78006 allows unauthenticated attackers to execute arbitrary code with the privileges of the web server process. This can lead to full site compromise, data exfiltration, and lateral movement within the hosting environment. All WordPress sites utilizing The Events Calendar version 6.17.4 or earlier are at risk if comments are enabled on event pages.

Recommendation

• Immediately update The Events Calendar plugin to the latest version, ensuring all installations are beyond version 6.17.4.
• As a temporary mitigation, disable comments on all event-related posts until the plugin has been patched.
• Audit web server logs for suspicious HTTP POST requests directed toward comment submission endpoints that contain unexpected block-like serialized strings or PHP magic method patterns.