CVE-2026-78006 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in The Events Calendar, a plugin running on more than 600,000 WordPress sites — and unlike most CVEs we cover, researchers have already observed active exploitation of it in the wild. If this plugin is active on a site you manage, patching isn’t optional homework, it’s urgent.
How the Attack Works
The flaw lives in the plugin’s is_safe_widget_instance function, which lacks the protection needed against PHP object injection. PHP’s “magic methods” can be triggered before unserialize() even finishes running, and the plugin doesn’t stop a crafted payload from reaching that function during event rendering. The unusual part of the attack chain: an attacker doesn’t need to log in, register, or even get a comment approved. They submit malicious block markup as a plain comment on an event page — and because WordPress lets comment authors preview their own pending comment through a moderation link, the payload executes without ever needing admin approval. It only works when comments are enabled on event pages and the plugin’s “Show comments on event pages” setting is active, but that’s a fairly common default-adjacent configuration.
Who’s Affected
| Version | Status |
|---|---|
| 6.17.4 and earlier | Vulnerable — actively exploited, update immediately |
| 6.17.4.1 or later | Patched |
What to Do Right Now
- Update The Events Calendar to 6.17.4.1 or later immediately — this is the single most important step, given confirmed in-the-wild exploitation.
- If you can’t update immediately, disable comments on event pages as a stopgap — the attack path specifically requires comments to be enabled there.
- Check recent comments on event pages for anything containing unusual block markup or serialized-looking data, even comments that were never approved.
- Look for signs of a completed compromise — unfamiliar admin accounts, unexpected files, or altered core/plugin files — if the site ran an unpatched version for any length of time after disclosure.
Why This One Is More Urgent Than Most
Most of the CVEs we cover here are serious but theoretical for any specific site until someone actively targets it. This one is different: security researchers have confirmed real attacks against real sites using this exact exploit chain, which means the window between “patch available” and “widely exploited” has already closed for a meaningful share of the 600,000+ sites running this plugin.
If you find signs your site was already compromised, we cover the recovery process in WordPress Site Hacked? Here’s the Recovery Checklist We Actually Use. Want a site checked directly? Get in touch.
Frequently Asked Questions
Do I need to have event comments enabled for this to matter?
The specific exploit chain does require comments enabled on event pages with the “Show comments” setting active. If that’s off, your immediate exposure to this exact attack path is lower, but you should still update promptly since settings can change.
Does the attacker need an approved comment to succeed?
No — that’s what makes this attack particularly dangerous. WordPress’s own comment-preview-for-authors feature lets the payload execute via a pending comment’s moderation link, without any admin ever approving it.
Is updating enough if my site was already attacked?
No. Updating closes the vulnerability going forward but doesn’t remove anything an attacker already planted. Given confirmed active exploitation, treat any unpatched site that’s been live recently as a potential incident, not just a theoretical risk.
Featured image: original illustration.