A critical flaw (CVSS 9.8, per the provisional NVD record) in StellarWP's The Events Calendar plugin lets unauthenticated attackers execute arbitrary code on WordPress servers running any version up to and including 6.17.3.
What Is It
CVE-2026-78159 is a code injection vulnerability (CWE-94) in the parse_array function of The Events Calendar plugin for WordPress. The plugin performs insufficient validation on the widget classes map: a plain-array payload bypasses the is_safe_widget_instance() object check and reaches the callable-invocation sink in Element_Classes::parse_array(). The result is code execution on the server with no authentication and no user interaction.
The attack chain has specific preconditions. The targeted site must have comments enabled on tribe_events posts, and at least one comment containing a crafted wp:legacy-widget block must have been submitted. Execution triggers when do_blocks() processes the single-event HTML, which includes the comment area.
Why It Matters
The record carries a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, no user interaction, with high impact to confidentiality, integrity, and availability. That score and vector come from the initial Wordfence submission and have not yet been through NVD analysis: the record was published 2026-09-12 and currently carries a vulnerability status of "Received," so both the severity rating and the affected-version range should be treated as provisional and may change on reanalysis.
Taking the vector at face value, the exposure is severe. Because the injection point is a public comment, an attacker only needs the ability to post a comment on an event page; the payload then fires on ordinary page rendering. Full server-side code execution on a WordPress host typically means database access, credential theft, and persistence.
CVE-2026-78159 does not appear in the CISA Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog), so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor: StellarWP
- Product: The Events Calendar (WordPress plugin)
- Affected versions: all versions from 0 through and including 6.17.3 (semver), as claimed in the unanalyzed record
Sites are only exploitable via the documented chain if comments are enabled on tribe_events posts.
Patch Status
Neither the NVD record nor the Wordfence advisory names a fixed version. Two WordPress plugin repository changesets (3667866 and 3667867) are referenced against the-events-calendar and are linked below. Administrators running 6.17.3 or earlier should update to the latest available release; as an interim mitigation, the described chain depends on comments being enabled on tribe_events posts.