The Events Calendar WordPress Plugin Unauthenticated RCE via Widget Class-Map Bypass
Unauthenticated RCE in The Events Calendar WordPress plugin through 6.17.3. Plain-array inputs bypass the widget safety check and reach a callable sink.
- Vendor
- StellarWP / Tribe
- Product
- The Events Calendar (WordPress plugin)
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.4%
- Status
- patched
- Published
Is CVE-2026-78159 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-78159 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-78159 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-78159 is a critical unauthenticated remote code execution vulnerability in The Events Calendar plugin for WordPress. It affects all versions through 6.17.3.
The flaw is in Element_Classes::parse_array(), part of the Tribe common library bundled with The Events Calendar and related StellarWP plugins. The function checks widget class maps for safety but does not reject plain-array inputs. A plain-array payload bypasses is_safe_widget_instance() and reaches the callable-invocation sink in parse_array() without authentication. Code runs on the server.
Mitigation: Update The Events Calendar to the latest available release. If immediate patching isn’t possible, disable the plugin on internet-facing sites.
See also: CVE-2026-78006, a companion flaw in the same subsystem affecting versions through 6.17.4.
Other StellarWP / Tribe CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-78006 The Events Calendar WordPress Plugin Unauthenticated RCE via Unserialize Chainwrite-up | [ CRITICAL ] | 9.8 | 1.5% | — |
