Two Critical Vulnerability Chains in The Events Calendar Plugin Allow Unauthenticated Remote Code Execution
Wordfence has identified two critical vulnerability chains in The Events Calendar WordPress plugin, enabling unauthenticated remote code execution through PHP Object Injection or arbitrary callable invocation.
Wordfence Argus, the threat intelligence arm of Wordfence, has uncovered two distinct and critical vulnerability chains within The Events Calendar, a widely-used WordPress plugin installed on over 600,000 websites. Both chains exploit flaws in the plugin's widget-rendering pipeline, ultimately allowing unauthenticated attackers to achieve Remote Code Execution (RCE) on the affected server.
The first vulnerability chain leverages PHP Object Injection. Attackers can inject serialized PHP objects that, when deserialized by the plugin, lead to the execution of arbitrary operating system commands. This method is particularly dangerous as it bypasses typical security measures designed to prevent code execution.
The second chain offers an alternative path to compromise. It abuses an arbitrary-callable primitive, bypassing the object-injection guard. Successful exploitation of this chain allows an attacker to reset an administrator's password. Once control of an administrative account is gained, the attacker can then upload a malicious plugin, effectively taking complete control of the website.
Crucially, neither of these exploits requires any form of authentication, login, or account registration. The primary prerequisites for exploitation are that comments must be enabled on the target event page and that The Events Calendar's specific option to "Show comments on event pages" is active. Both attack vectors can be triggered through WordPress's pending-comment preview mechanism, meaning an attacker can exploit the vulnerability without requiring moderator approval.
The potential impact of a successful exploitation is severe, ranging from complete website takeover and the theft of sensitive data to the deployment of malware and a total loss of confidentiality, integrity, and availability for the affected site. This makes timely patching and security vigilance paramount for administrators using The Events Calendar.
Wordfence Premium, Wordfence Care, and Wordfence Response users received immediate protection via a firewall rule on August 22, 2026. Users of the free Wordfence plugin will receive similar protection starting September 21, 2026. StellarWP, the developer of The Events Calendar, was notified promptly, with the first vulnerability disclosed on August 21, 2026, and the second on August 23, 2026. The company responded commendably, releasing an initial patch on August 25, 2026, and a fully patched version on September 10, 2026.
Wordfence strongly urges all users of The Events Calendar to update to the latest patched version, 6.17.4.1, as soon as possible to mitigate these critical risks. The vulnerabilities, identified as CVE-2026-78006 (PHP Object Injection) and CVE-2026-78159 (Arbitrary Callable Invocation), carry a CVSS rating of 9.8, underscoring their critical severity.