The Events Calendar WordPress Plugin Unauthenticated RCE via Widget Class-Map Bypass
Unauthenticated RCE in The Events Calendar WordPress plugin through 6.17.3. Plain-array inputs bypass the widget safety check and reach a callable sink.
- Vendor
- StellarWP / Tribe
- Product
- The Events Calendar (WordPress plugin)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.8%
- Status
- patched
- Published
CVE-2026-78159 is a critical unauthenticated remote code execution vulnerability in The Events Calendar plugin for WordPress. It affects all versions through 6.17.3.
The flaw is in Element_Classes::parse_array(), part of the Tribe common library bundled with The Events Calendar and related StellarWP plugins. The function checks widget class maps for safety but does not reject plain-array inputs. A plain-array payload bypasses is_safe_widget_instance() and reaches the callable-invocation sink in parse_array() without authentication. Code runs on the server.
Mitigation: Update The Events Calendar to the latest available release. If immediate patching isn’t possible, disable the plugin on internet-facing sites.
See also: CVE-2026-78006, a companion flaw in the same subsystem affecting versions through 6.17.4.
