Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take control of affected websites. The flaws can enable remote code execution, administrator password resets and malware installation. With more than 600,000 active installations, site owners should treat updating the plugin as an urgent maintenance task.
Key takeaways
- Two flaws, CVE-2026-78006 and CVE-2026-78159, have a CVSS score of 9.8.
- The attacks can begin through a crafted comment on a public event page.
- The vulnerable path does not require an account, login or moderator approval.
- Version 6.17.4.1 contains the complete fix.
- Site owners should review administrator accounts and logs after updating.
Why the vulnerabilities matter
The affected plugin is widely used to add calendars and event listings to WordPress websites. Researchers found two separate attack chains in the way its single-event template processes comments and widget data.
If successfully exploited, one flaw could allow an attacker to run operating system commands with the permissions of the web server. The other could be used to reset an administrator’s password, allowing the attacker to sign in and upload a malicious plugin. These outcomes could lead to data theft, defacement, malware deployment or wider server compromise.
How an attack could start
The vulnerabilities affect public event pages where comments are enabled and displayed. An attacker can submit a specially prepared comment and use WordPress’s preview function to trigger the vulnerable rendering process, even while the comment remains pending moderation.
The first chain, CVE-2026-78006, involves unsafe handling of PHP object data. The second, CVE-2026-78159, abuses attacker-controlled data passed into a function-processing part of the plugin. In practical terms, normal comment moderation is not enough protection because the malicious content can be processed before approval.
Update The Events Calendar immediately
StellarWP, the plugin’s developer, released fixes after receiving reports from Wordfence. The fully patched release is The Events Calendar 6.17.4.1. Administrators should update through the WordPress dashboard or their usual maintenance system and confirm that the active version is correct.
Temporarily disabling comments on event pages can reduce exposure, but it is not a substitute for updating. Other safeguards, such as a web application firewall, may help block known attack patterns but cannot repair the vulnerable code.
What site owners should check
After updating, review the site for signs of unauthorised activity, particularly if comments were enabled on event pages. A WordPress care plan can make this process more reliable by combining routine updates, security monitoring and regular backups.
Recommended checks include:
- Review administrator accounts and remove unfamiliar users.
- Check password-reset records, login history and recently installed plugins.
- Inspect server and WordPress logs for unusual requests or command activity.
- Change administrator passwords and enable multi-factor authentication.
- Confirm that backups are recent and stored separately from the website.
A managed WordPress maintenance plan can also help ensure critical plugin updates are tested and applied promptly, reducing the time a site remains exposed to newly disclosed flaws.
The wider WordPress maintenance lesson
This incident highlights why plugin security needs ongoing attention. A website can remain vulnerable even when its core software is current, because third-party plugins often provide an additional route into the administration area.
For organisations that rely on event registrations, bookings or public information pages, regular WordPress maintenance is especially important. Keeping plugins updated, monitoring changes and having a tested recovery plan can limit both the likelihood and impact of a site takeover.