CVE-2026-78159
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
Early warning: exploitation observed
- Exploitation observed since Sep 14, 2026
- Not yet in the official CISA catalogue
- First attack observed 2 days after disclosure
Source: VulnCheck KEV · Sep 14, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRelated articles
Critical Events Calendar Flaws Put More Than 200,000 WordPress Sites at Risk
Two critical 9.8 RCE flaws in The Events Calendar plugin expose 200,000+ WordPress sites. Update to version 6.17.4.1 to fix both vulnerabilities.
Attackers Exploit WooCommerce Plugin Flaw to Install PHP Web Shells
Attackers exploit CVE-2026-27540 in a WooCommerce plugin to upload PHP web shells. Learn the indicators, impact, and recommended defenses.
This product uses the NVD API but is not endorsed or certified by the NVD.