Critical WordPress Plugin Flaws Expose 600,000+ Sites to Takeover

Key Takeaways

• Two critical, unauthenticated vulnerabilities have been discovered in The Events Calendar WordPress plugin.
• Over 600,000 active WordPress sites utilizing the plugin are exposed to potential remote code execution and full site takeover.
• Both flaws, CVE-2026-78006 and CVE-2026-78159, carry a CVSS score of 9.8.
• Immediate updates to version 6.17.4.1 or later are crucial for all affected installations.

Critical Flaws Threaten Over 600,000 WordPress Sites

More than 600,000 WordPress installations face severe risk due to two critical vulnerabilities identified in The Events Calendar plugin. These flaws could allow unauthenticated attackers to achieve remote code execution, reset administrator passwords, deploy malware, and ultimately compromise entire web servers.

The Wordfence Threat Intelligence team, leveraging their Argus system, identified these independent vulnerability chains on August 21 and August 22, 2026. Both issues stem from the plugin’s widget-rendering process and can be exploited without requiring any user authentication, account registration, or interaction.

The affected plugin, developed by StellarWP, is widely used for managing events on WordPress sites. Administrators are urged to update to version 6.17.4.1 or newer without delay to mitigate these risks.

Unauthenticated PHP Object Injection Leads to RCE

The first vulnerability, tracked as CVE-2026-78006, has been assigned a critical CVSS score of 9.8. This flaw impacts The Events Calendar versions up to 6.17.4 and enables attackers to exploit PHP object injection for executing arbitrary operating system commands on the vulnerable server.

The attack vector for CVE-2026-78006 begins when a malicious user submits a specially crafted comment to an event page. This method is effective only if comments are enabled for event pages and the plugin’s “Show comments on event pages” setting is active. Crucially, the attacker does not need their comment to be approved, as WordPress provides a moderation link that allows comment authors to preview their pending submissions.

The Events Calendar processes the entire event page, including comments, as Gutenberg blocks. This architectural design flaw permits malicious block content embedded within a pending comment to reach the plugin’s widget-rendering code. Researchers discovered that a malformed serialized PHP payload could bypass the plugin’s validation checks for widget instances before a trusted WordPress hash is generated. Despite attempts by the plugin to block dangerous objects, PHP’s “magic methods” can be triggered during the processing of attacker-controlled data, leading to command execution via a vulnerable deserialization routine. This could grant an attacker the ability to run commands with the permissions of the web server user, potentially leading to data exfiltration, website defacement, malware installation, or lateral movement within the hosting environment.

Separate Path Allows Admin Password Reset and RCE

The second vulnerability, CVE-2026-78159, also carries a critical CVSS score of 9.8 and affects versions of the plugin up to 6.17.3. This flaw presents an alternative method for attackers to gain control over a website.

Instead of relying on object injection, this attack utilizes a specially crafted array that successfully bypasses the plugin’s internal safety checks. The attacker-controlled data is then fed into the widget template system, where it can interact with a function capable of accepting callable PHP functions. Researchers demonstrated that this behavior could be abused to invoke WordPress functions with attacker-supplied arguments. A significant impact highlighted was the ability to reset the site administrator’s password. Once the administrator password is reset, the attacker can log in with administrative privileges, upload a malicious plugin, and ultimately achieve remote code execution.

StellarWP received the vulnerability reports through the Wordfence Vulnerability Management Portal. The vendor acknowledged both reports promptly on August 24, 2026, and released patches shortly thereafter. The fully secured version is 6.17.4.1.

Wordfence Premium, Care, and Response customers received firewall protection against known exploit attempts on August 22, 2026. Free Wordfence users are slated to receive the same protective rule on September 21, 2026.

What You Should Do

• Update Immediately: Upgrade The Events Calendar plugin to version 6.17.4.1 or later without delay.
• Review Comment Settings: Check if comments are enabled on event pages and consider disabling them if not strictly necessary.
• Remove Unused Plugins: Deactivate and delete any plugins that are not essential for your website’s operation.
• Monitor Administrator Accounts: Scrutinize all administrator accounts for any unauthorized activity or changes.
• Inspect Server Logs: Regularly review server logs for suspicious entries or signs of compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.