Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-78006 2026-09-12

CVE-2026-78006: Unauthenticated RCE in The Events Calendar for WordPress

"A deserialization flaw in The Events Calendar plugin is reported to let unauthenticated attackers execute code on WordPress servers running any version up to and including 6.17.4, carrying a CVSS 3.1 score of 9.8…"

A deserialization flaw in The Events Calendar plugin is reported to let unauthenticated attackers execute code on WordPress servers running any version up to and including 6.17.4, carrying a CVSS 3.1 score of 9.8 (Critical).

What Is It

CVE-2026-78006 is a CWE-502 deserialization of untrusted data vulnerability in The Events Calendar, a WordPress plugin published by StellarWP. The flaw sits in the is_safe_widget_instance function, which reportedly provides insufficient protection against malicious serialized payloads. Per the Wordfence advisory, the check can be bypassed because enable_rendering_widget_copied() forges a valid wp_hash integrity attribute, so the payload passes the safety check and reaches unserialize(). Once attacker-controlled data is deserialized, PHP object instantiation invokes magic methods on the resulting objects, the standard mechanism behind PHP object-injection chains, which the advisory describes as reaching remote code execution on the server with no authentication required. The specific gadget chain is not detailed in the material provided.

Why It Matters

The delivery path described in the advisory requires no account and no administrator approval. The plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress hands an unauthenticated commenter a moderation-hash URL that lets them immediately view their own pending comment. If that behavior holds as described, it would be enough to push injected block markup into the vulnerable code path before any moderation step occurs.

The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflects network-reachable, low-complexity exploitation with no privileges or user interaction, and full compromise of confidentiality, integrity, and availability. Note that this vector is the submitting CNA's assessment; NVD has not yet completed its own analysis.

What's Vulnerable

Exploitation reportedly requires that comments be enabled and visible on events. Sites that have disabled or hidden event comments are described as not exposing this attack path.

Patch Status

The NVD record is in "Received" status as of its 2026-09-12 publication, meaning the details above come from the submitting CNA (Wordfence) and have not been independently analyzed or enriched by NVD. Technical specifics, affected-version ranges, and the CVSS score may change once analysis completes. No fixed version is stated in the supplied data, though a plugin changeset is referenced in the advisory sources below.

This CVE does not appear in the CISA KEV catalog in the material provided, so there is no confirmed active exploitation or federally mandated remediation deadline associated with it at this time.

Given the unanalyzed status, administrators should treat the affected-version range as the actionable item: update The Events Calendar to the latest available release and, as an interim mitigation, consider disabling comments on event post types until a confirmed fixed version is published.

Sources