The Events Calendar: unauthenticated RCE on 600k sites

If your WordPress site runs an events calendar, check the version before you read the rest of this. The Events Calendar — 600,000+ active installs — carries two separate unauthenticated remote code execution bugs, both scored CVSS 9.8, published on September 12. No login. No admin approval. On one of them, a comment sitting unapproved in your moderation queue is enough to fire the chain.

What actually happened

Wordfence, acting as CVE Numbering Authority, published CVE-2026-78006 and CVE-2026-78159 on September 12. Both carry the same vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Network reachable, low complexity, no privileges, no user interaction, full compromise.

Both live in the same feature — copied widget instances — and both defeat the same guard function, is_safe_widget_instance().

CVE-2026-78159 affects everything up to and including 6.17.3. The parse_array function does not validate the widget classes map, so a plain-array payload slips past the object check and reaches a callable-invocation sink in Element_Classes::parse_array(). The delivery path is the interesting part: the V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns the moderation-queue markup to the submitter. So the precondition is comments enabled on tribe_events posts plus one submitted comment carrying a crafted wp:legacy-widget block. Approval is not required.

CVE-2026-78006 affects everything up to and including 6.17.4. Here is_safe_widget_instance is bypassed because PHP fires magic methods during its pre-parse, while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute before unserialize() is reached.

The fix is 6.17.4.1, shipped September 10. Read the plugin changelog and the pattern is hard to miss:

• 6.17.3 (Aug 20) — "Hardened validation of copied legacy widget instances."
• 6.17.3.1 (Aug 26) — "Harden validation of copied widget instance data."
• 6.17.4.1 (Sep 10) — "Strengthened validation of copied widget instances."

Three passes at the same bug class in three weeks. The first two did not hold.

Why an unauthenticated RCE on WordPress matters for your business

This is not a defacement bug. Remote code execution on a WordPress host means the attacker runs PHP as your web user: read wp-config.php, take the database credentials, take the SMTP credentials, take whatever API keys your plugins stored in the options table. If that box also runs your storefront or your booking flow, they now own the payment integration too.

Update to 6.17.4.1 tonight. It is a patch release. There is no migration, no downtime story, no reason to schedule it for the weekend.

Then turn off comments on event posts. CVE-2026-78159 needs comments enabled on tribe_events to deliver the payload. Almost nobody uses comments on calendar entries, and almost everybody has them on because the post type inherited the site default. Disable them and you remove the delivery path for that whole class of bug, not just this one.

Then decide whether you actually need the plugin. An events calendar that renders a date grid should not be a remote code execution surface. If you use a fraction of what it ships — and most sites do — weigh a custom post type and a template against 600,000 installs' worth of attacker attention.

Sources: Wordfence: CVE-2026-78006, Wordfence: CVE-2026-78159, The Events Calendar changelog.