Events Calendar Plugin: Two CVSS 9.8 RCEs

The Events Calendar WordPress plugin shipped two unauthenticated remote code execution vulnerabilities into NVD on September 12. CVE-2026-78159 and CVE-2026-78006 both score CVSS 9.8, critical. Every version through 6.17.4 is affected.

What to do: Update to the latest release of The Events Calendar. If you cannot update right now, disable the plugin on any internet-facing site. An unauthenticated critical RCE is not a “patch by end of week” situation.

The flaws

CVE-2026-78159 is in Element_Classes::parse_array(), part of the Tribe common library shared across The Events Calendar and other StellarWP plugins. The function validates widget class maps against a safety check, but plain-array inputs bypass that check entirely and reach a callable-invocation sink. No authentication required. According to the NVD entry, versions through 6.17.3 are affected.

CVE-2026-78006 is a companion flaw in the same widget subsystem, specifically is_safe_widget_instance(). PHP fires magic methods during pre-parsing; the plugin’s enable_rendering_widget_copied() function forges a valid integrity hash before unserialize() is reached. An unauthenticated attacker can use this chain to push attacker-controlled data through to unserialize() and execute code on the server. The NVD entry covers versions through 6.17.4.

Neither flaw requires a login. Both result in server-side code execution.

Patch this first

Unauthenticated CVSS 9.8 flaws in active WordPress plugins draw automated scanner traffic within hours of NVD publication. Update now, then verify the plugin version in your WordPress dashboard. If you run a managed WordPress host, check whether auto-updates are enabled for plugins.

This is the third critical unauthenticated flaw in a major WordPress plugin since early September. See also: Frontend Admin Plugin Flaw Allows WordPress Account Takeover, Elementor Pro Flaw Exploited to Backdoor WordPress Sites, and All-in-One WP Migration Flaw Hits 3M WordPress Sites.