The Events Calendar WordPress Plugin Unauthenticated RCE via Unserialize Chain
Unauthenticated RCE in The Events Calendar WordPress plugin through 6.17.4. PHP magic method dispatch plus a forged hash allows attacker input to reach unserialize().
- Vendor
- StellarWP / Tribe
- Product
- The Events Calendar (WordPress plugin)
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.5%
- Status
- patched
- Published
Is CVE-2026-78006 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-78006 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-78006 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-78006 is a critical unauthenticated remote code execution vulnerability in The Events Calendar plugin for WordPress. It affects all versions through 6.17.4.
The flaw is in is_safe_widget_instance() in the Tribe common library. PHP fires magic methods during pre-parsing of widget instances. The plugin’s enable_rendering_widget_copied() function forges a valid wp_hash integrity attribute before unserialize() is reached. An unauthenticated attacker can exploit this to push attacker-controlled data through to unserialize() and execute arbitrary code on the server.
Mitigation: Update The Events Calendar to the latest available release. Versions through 6.17.4 are affected. If immediate patching isn’t possible, disable the plugin on internet-facing sites.
See also: CVE-2026-78159, a companion flaw in the same plugin affecting versions through 6.17.3.
Other StellarWP / Tribe CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-78159 The Events Calendar WordPress Plugin Unauthenticated RCE via Widget Class-Map Bypasswrite-up | [ CRITICAL ] | 9.8 | 1.4% | — |
