Remote Code Execution in The Events Calendar WordPress Plugin

The Events Calendar plugin for WordPress is vulnerable to an unauthenticated Remote Code Execution (RCE) flaw, tracked as CVE-2026-78159. This vulnerability affects all versions up to and including 6.17.3. The flaw resides within the Element_Classes::parse_array method, which fails to adequately validate the widget 'classes' map.

An attacker can supply a specially crafted wp:legacy-widget block within a comment on a tribe_events post. This payload bypasses the is_safe_widget_instance() object validation check. When the WordPress do_blocks() function processes the page content - specifically including the comment section - it triggers a callable-invocation sink in the parse_array function, enabling arbitrary PHP code execution. This vulnerability is critical as it requires no authentication to exploit, relying only on the presence of comments on events posts.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the underlying web server hosting the WordPress site. This can lead to full site compromise, data exfiltration, and the installation of persistent backdoors. Given the widespread use of The Events Calendar plugin, this vulnerability poses a high risk to organizations hosting event-driven content on WordPress.

Recommendation

Prioritize the immediate update of The Events Calendar plugin to the latest version (patching CVE-2026-78159). For instances where immediate patching is not possible, disable comments on all tribe_events post types to break the exploitation vector. Monitor web server logs for HTTP POST requests directed at comment submission endpoints that contain serialized or legacy widget-related strings if WAF virtual patching is required.