Two disclosed vulnerabilities in The Events Calendar plugin could let attackers run code on affected WordPress sites without logging in. Both flaws involve event comments processed during page rendering, but use different technical routes. Site owners should check their plugin version, confirm a fix for both issues is installed and review comment settings while they assess exposure.
Key takeaways
- The flaws are tracked as CVE-2026-78006 and CVE-2026-78159.
- Reported vulnerable versions extend through 6.17.4 for one issue and 6.17.3 for the other.
- Exploitation depends on event comments and particular rendering paths; the reported attack does not require an attacker account.
- Update to a release confirmed to fix both vulnerabilities. If that is not immediately possible, disable comments on events and check for signs of compromise.
What the vulnerabilities do
CVE-2026-78006 is an insecure deserialisation flaw: crafted data can pass checks and reach PHP’s unserialize() function. CVE-2026-78159 involves inadequate validation of widget data, which may allow attacker-controlled input to be treated as a callable. Both paths can lead to remote code execution, potentially allowing an attacker to take control of a vulnerable site.
The reported attack chains depend on comments being enabled for events and on the plugin processing comment content through its event-page rendering flow. In one scenario, a commenter can use a moderation link to view a pending comment; in the other, a crafted comment may be processed when someone loads the event page.
Which sites may be affected
The reported version ranges are not identical: CVE-2026-78006 affects versions up to and including 6.17.4, while CVE-2026-78159 affects versions up to and including 6.17.3. Sites using event comments and the relevant rendering features warrant particular attention.
Check the installed plugin version in WordPress and consult the vendor’s release information to confirm that the version you install addresses both flaws. If you cannot verify a fix straight away, temporarily close comments on event posts. A web application firewall may provide an additional layer of defence, but should not replace updating the plugin.
What WordPress site owners should do
After updating, review recent event comments for unexpected block markup and inspect logs for suspicious comment submissions followed by requests to view event pages. Check for unfamiliar administrator accounts, unexpected files and other signs that the site may have been altered. If you suspect a compromise, take the site through a security review and rotate credentials and WordPress secrets as appropriate.
A WordPress maintenance plan or care plan can help make these steps routine: applying updates promptly, keeping verified backups and monitoring for unusual changes. For busy site owners, that ongoing care can reduce the chance that a critical plugin update is missed—and help speed up recovery if an incident occurs.
Sources
- CVE-2026-78006: The Events Calendar WordPress Plugin RCE, SentinelOne.
- CVE-2026-78159: Events Calendar WordPress Plugin RCE Flaw, SentinelOne.