External risk intelligence

The Events Calendar WordPress Plugin Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-78159

The vulnerability affects a WordPress plugin, which by design powers public-facing websites. Because the attack vector is unauthenticated and triggered through standard public interaction with comments on a post, the vulnerable component is exposed to the internet in the normal course of operation for any site using the plugin.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in The Events Calendar plugin for WordPress, allowing unauthenticated attackers to execute arbitrary code on the server. This issue stems from insufficient validation within the plugin's widget class handling, which can be triggered through specially crafted comments on posts when comments are enabled. The potential for remote code execution, even under specific site configurations, presents a significant security risk.

Attackers can run their own code on your website.
Critical vulnerability affects widely used WordPress plugin.
Confirm if your sites are exposed and take appropriate action.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by submitting a specially crafted comment containing a legacy widget block on a WordPress site that has comments enabled for event posts. When the site processes the comments, the malicious input reaches a vulnerable function that fails to properly validate it. This allows the attacker to execute arbitrary code on the server.

No authentication required.
Comments with legacy widget blocks.
Remote code execution on server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on the server when specific conditions are met, such as comments being enabled on posts. This could lead to a complete compromise of the affected WordPress site.

Server-side code execution.
Crafted comment submission.
Full website compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress Events Calendar plugin, specifically versions up to 6.17.3, is vulnerable to remote code execution. This impacts application owners and platform teams responsible for WordPress instances. The initial step is to identify all WordPress sites utilizing this plugin, confirm if comments are enabled on event posts, and assess if any comments contain the crafted block, as this is a prerequisite for exploitation. Then, the accountable owner should be identified to plan remediation based on the identified risk.

Identify WordPress sites and plugin owners.
Verify comment status and crafted block presence.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is The Events Calendar plugin?

The Events Calendar is a popular WordPress plugin used to manage and display event schedules, venues, and calendars on websites. It adds functionality to create event-based content and interactive features, often used by businesses, organizations, and community sites to keep audiences updated on upcoming activities.

What does CWE-94 mean in CVE-2026-78159?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. In plain terms, the plugin fails to properly check data provided by users before processing it. This weakness allows an attacker to inject their own instructions into the application, which the server then executes as if it were legitimate code.

How is this RCE triggered?

An attacker triggers the vulnerability by submitting a comment containing a specially crafted 'wp:legacy-widget' block on a site where comments are enabled for event posts. The code execution happens when the plugin processes these comments and fails to filter the malicious input. If comments are disabled on event posts, this specific attack path is not available.

Is my site at risk?

Halo Surface Signal identifies this as high risk because the plugin is designed for public-facing websites. Since the attack does not require a user account and occurs through standard comment interactions, any site using this plugin with comments enabled on events is effectively exposed to the internet and potential exploitation.

What should I do to secure my site?

First, identify all instances of The Events Calendar running version 6.17.3 or earlier. Check if your event posts allow comments, as this is a requirement for the attack. If you identify vulnerable versions, prioritize updating to a secure version as soon as possible. As a temporary measure, consider disabling comments on event posts if they are not strictly necessary for your site's functionality.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.