Two Unauthenticated RCE Flaws Risk Takeover of 200,000+ Sites

Two unauthenticated remote code execution vulnerabilities were found in The Events Calendar WordPress plugin and patched by developer StellarWP in August and September. The defects are tracked as CVE-2026-78159 and CVE-2026-78006 and were resolved in versions 6.17.3.1 and 6.17.4.1 respectively.

WordPress security firm Defiant reported that CVE-2026-78159 is an unauthenticated code-injection flaw with a CVSS score of 9.8. Under certain conditions an attacker can inject a plain-array payload that bypasses validation while the plugin processes single-event HTML, including the area where event comments display. StellarWP released a patch for this flaw on August 25 in The Events Calendar version 6.17.3.1.

The second defect, CVE-2026-78006 and also scored 9.8, is an unauthenticated PHP object injection. That issue can be exploited when event comments are enabled and visible: a commenter can submit content that reaches the vulnerable function before moderation and trigger execution. StellarWP fixed that issue on September 10 in version 6.17.4.1.

Both flaws are separate exploitation chains but result in the same outcome: remote code execution and possible full compromise of the WordPress installation. The Events Calendar reports more than 600,000 active installations. WordPress usage data indicates roughly 240,000 sites run versions of the plugin prior to 6.17, making them potentially exposed to both vulnerabilities. Download counts between September 10 and 14 show the plugin was obtained just over 300,000 times, indicating many installations may still run vulnerable releases for the second flaw.

Defects stem from insufficient input validation and inadequate protections in functions that process user-supplied content. Exploitation methods include crafted payloads in single-event HTML for the first flaw and object injection via event comments for the second, where the injected content is processed before moderation.

Site administrators are advised to update The Events Calendar to version 6.17.4.1 or later. Until sites are patched, administrators that permit event comments may face heightened risk of takeover because the vulnerabilities can allow attackers to run server-side code, modify site content, install persistent backdoors or access stored data.