The Events Calendar, a WordPress plugin running on more than 100,000 sites, has two newly disclosed critical vulnerabilities that allow unauthenticated remote code execution. Wordfence published CVE-2026-78006 and CVE-2026-78159 on September 12, 2026, both rated 9.8 on the CVSS scale. Both stem from the same broken safety check in the plugin’s legacy widget code, and both are fixed if you’re already running version 6.17.4.1 or later.
What the Two Flaws Actually Do
The plugin has a function called is_safe_widget_instance() that’s supposed to stop it from unserializing untrusted widget data when a legacy widget gets copied. Both CVEs are ways around that one check.
CVE-2026-78159 affects versions up to and including 6.17.3. An attacker sends a plain array instead of an object through the widget’s “classes” map, which slips past the safety check and lands in a callable-invocation sink inside Element_Classes::parse_array(). That’s enough to run arbitrary code.
CVE-2026-78006 affects versions up to and including 6.17.4, meaning the first attempt at closing this hole didn’t fully work. This variant abuses the order PHP fires magic methods during parsing, combined with a forged integrity hash from enable_rendering_widget_copied(), to smuggle a malicious object past the check before unserialize() runs.
What makes both genuinely exploitable without a login: The Events Calendar’s V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress lets a commenter view their own pending comment immediately via a moderation-hash URL, before any moderation happens. An attacker submits a comment with a crafted wp:legacy-widget block, loads their own pending comment, and the payload executes. The only precondition is that comments are enabled and visible on your events.
Which Version Actually Fixes This
Both CVEs were disclosed after the fixes had already shipped. The Events Calendar 6.17.3.1, released August 26, 2026, hardened validation of copied widget instance data, closing the gap CVE-2026-78159 describes. Version 6.17.4.1, released September 10, 2026, tightened that same validation again after the first fix proved incomplete, addressing CVE-2026-78006.
If your site is on anything earlier than 6.17.4.1, you’re exposed to at least one of these. Check your installed version under Plugins in wp-admin and update now if you haven’t already.
What to Do About It
Update to 6.17.4.1 or later first, that closes both holes regardless of which version you’re coming from. If for some reason you can’t update immediately, disabling comments on your events (or at least turning off the ability to view pending comments) removes the delivery mechanism both exploits depend on.
This is also a good reminder to check what else on your site relies on legacy widget instances or custom comment handling, since that’s exactly the kind of interaction that’s easy to miss in a plugin audit. If you’re not sure what’s actually running on your WordPress site or want a second set of eyes on custom plugin code before it ships, that’s the kind of review our plugin development team does as a matter of course.
