The Events Calendar WordPress Plugin Unauthenticated RCE via Unserialize Chain
Unauthenticated RCE in The Events Calendar WordPress plugin through 6.17.4. PHP magic method dispatch plus a forged hash allows attacker input to reach unserialize().
- Vendor
- StellarWP / Tribe
- Product
- The Events Calendar (WordPress plugin)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.8%
- Status
- patched
- Published
CVE-2026-78006 is a critical unauthenticated remote code execution vulnerability in The Events Calendar plugin for WordPress. It affects all versions through 6.17.4.
The flaw is in is_safe_widget_instance() in the Tribe common library. PHP fires magic methods during pre-parsing of widget instances. The plugin’s enable_rendering_widget_copied() function forges a valid wp_hash integrity attribute before unserialize() is reached. An unauthenticated attacker can exploit this to push attacker-controlled data through to unserialize() and execute arbitrary code on the server.
Mitigation: Update The Events Calendar to the latest available release. Versions through 6.17.4 are affected. If immediate patching isn’t possible, disable the plugin on internet-facing sites.
See also: CVE-2026-78159, a companion flaw in the same plugin affecting versions through 6.17.3.
