External risk intelligence

The Events Calendar WordPress Plugin Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78006

The vulnerability exists in a widely used WordPress plugin designed for public-facing event management. Because it allows for unauthenticated interaction via public comment sections on event pages, the attack surface is exposed to the internet by design in standard web deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in The Events Calendar plugin for WordPress, affecting all versions up to 6.17.4. The flaw allows unauthenticated attackers to execute arbitrary code on the server, posing a significant risk to any WordPress site using this popular plugin for event management, especially if comments are enabled on event pages.

Unauthenticated attackers can run code on your server.
Affects a widely used WordPress event plugin.
Confirm relevance and assess exposure to this threat.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by submitting a specially crafted comment on a WordPress event page. This comment, when processed by the plugin's V2 template, can bypass security checks within the `is_safe_widget_instance` function. The plugin then deserializes malicious data, leading to the execution of arbitrary code on the server. This attack requires comments to be enabled and visible on event pages.

No authentication needed to access.
Triggered via comment on event page.
Results in unauthenticated code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary code on the server when comments are enabled and visible on event pages. The plugin's handling of widget rendering and unserialization, combined with WordPress's comment moderation process, creates a pathway for injecting malicious markup that triggers the vulnerable code path.

Server-side code execution.
Bypasses authentication via comment moderation.
Compromise of the WordPress site.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress Events Calendar plugin, particularly when comments are enabled on event pages, presents a clear ownership challenge that likely spans application, infrastructure, and security teams. The first practical move is to identify all WordPress instances using this plugin, confirm which are externally accessible and host business-critical content, and then assign ownership to the relevant team for risk-based remediation planning.

WordPress application owners should lead remediation.
Verify public-facing event pages with comments enabled.
Plan for plugin updates or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is The Events Calendar plugin?

The Events Calendar is a widely used WordPress extension that adds comprehensive event management features to a website. It allows site owners to create, display, and manage calendars and individual event pages, typically facilitating visitor engagement through event information, registrations, or discussions.

How does CVE-2026-78006 impact the server?

This vulnerability is classified as CWE-502, which refers to Deserialization of Untrusted Data. In this specific case, the plugin fails to properly validate data before processing it. Because PHP handles certain object operations during pre-parsing, an attacker can supply specially crafted data that the plugin unserializes, leading to Remote Code Execution where the attacker runs arbitrary commands on the underlying server.

Do I need comments enabled for this to trigger?

Yes. The vulnerability is triggered through the comment section of an event page. An attacker submits malicious block markup within a comment. If comments are disabled or not visible on your event pages, the specific code path that processes the malicious data is not reached, effectively negating this specific trigger.

Why is this considered an external risk?

Halo Surface Signal classifies this as an external risk because the plugin is designed for public-facing event management. Since the attack vector requires no authentication, any user browsing the internet can interact with event page comment sections to initiate the exploit. If your instance is internet-facing, the attack surface is exposed by design.

What is the first step to address this risk?

Immediately inventory all WordPress sites in your environment to identify which are running The Events Calendar plugin. Focus your assessment on public-facing sites that have event comments enabled, as these are the most direct targets. Once identified, prioritize these instances for updates and coordinate with your web application teams to manage the remediation process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.