CVE-2026-78006
The Events Calendar plugin for WordPress is vulnerable to remote code execution in all versions up to 6.17.4. The flaw lies in the is_safe_widget_instance function, which can be bypassed to inject code. Unauthenticated attackers can run arbitrary code if comments are enabled on events.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites using The Events Calendar plugin, versions 6.17.4 and earlier.
Real-world impact
An attacker could run any code on the web server, steal data, deface the site, or use the server for further attacks.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability allows remote code execution without authentication, with full impact on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
How it’s attacked
References & advisories
- plugins.trac.wordpress.org/browser/the-events-calendar…
- plugins.trac.wordpress.org/browser/the-events-calendar…
- plugins.trac.wordpress.org/browser/the-events-calendar…
- plugins.trac.wordpress.org/browser/the-events-calendar…
- plugins.trac.wordpress.org/browser/the-events-calendar…
- plugins.trac.wordpress.org/changeset
- wordfence.com/threat-intel/vulnerabilitie…