The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to

CVE-2026-78006 is an unauthenticated PHP object injection → deserialization → RCE chain in The Events Calendar plugin for WordPress, affecting all versions through 6.17.4. The vulnerability lives in Service_Provider.php (line 255) within the V2 Widgets subsystem. An attacker posts a crafted comment containing malicious block markup on any event page. WordPress's moderation-hash mechanism lets the commenter immediately view their own pending comment — this triggers the plugin's V2 single-event template to run do_blocks() over the buffered comment HTML, reaching is_safe_widget_instance(). The safety check is bypassable because PHP fires magic methods during pre-parse, and enable_rendering_widget_copied() forges a valid wp_hash integrity attribute, allowing the payload to reach unserialize() and execute arbitrary code. The fixed version is 6.17.4.1, released 2026-09-10.

The vendor's CRITICAL / 9.8 rating is justified and, if anything, slightly generous in the CVSS vector by marking AC:L. The one real prerequisite — comments must be enabled on event post types — is the WordPress default. The V2 template is also the default. With ~800,000 active installs and a public PoC already circulating (DeadExpl0it), this is a textbook mass-exploitation candidate. The only reason it hasn't hit KEV yet is that it was disclosed *yesterday*. noisgate agrees with CRITICAL.

Why this verdict

• Unauthenticated network access: AV:N/PR:N/UI:N — no credentials, no phishing, no user click required. This is the lowest-friction initial access vector possible.
• Weaponized public PoC: The DeadExpl0it exploit is not a proof-of-concept — it is a turnkey exploitation tool with multi-target scanning, webshell deployment, and admin account creation. Script kiddies can run this today.
• Massive attack surface: 800,000 active installs. The Events Calendar is the dominant plugin in its category. Enterprise WordPress fleets frequently include this plugin for conference sites, HR portals, and marketing pages.
• Default-vulnerable configuration: Comments are enabled by default in WordPress. The V2 template is the default since Events Calendar 5.x. The vast majority of installs meet all prerequisites without any administrator misconfiguration.
• Role multiplier: WordPress servers occupy the web/application tier (role b — typical). However, wp-config.php contains database credentials, and enterprise WordPress instances often connect to shared MySQL/MariaDB backends hosting multiple sites. Compromise of one instance can pivot to the database tier, reaching tenant-to-multi-tenant blast radius. For organizations using WordPress as their public web presence (marketing, investor relations, e-commerce), the reputational and data-exposure blast radius is significant. While this is not a domain controller or hypervisor, the installed base is large enough and the chain is frictionless enough that CRITICAL is warranted on volume and ease alone.

Why not higher?

A 9.8 would require literally zero prerequisites. The comment-enabled requirement, while default-on, does technically narrow the population slightly. Some managed WordPress hosts (WP Engine, Pantheon) deploy with read-only filesystems that limit persistence. The scope is Unchanged (S:U), meaning no cross-component impact within the CVSS model. noisgate settles at 9.4.

Why not lower?

Downgrading below CRITICAL would require meaningful friction in the attack chain — there is almost none. The exploit is unauthenticated, the PoC is weaponized and public, the install base is massive, and the default configuration is vulnerable. Even the comment prerequisite fails as a friction point because WordPress ships with comments on. The 1-day-old disclosure means the patch adoption rate is near zero, maximizing the window of exposure.

1. Disable comments on all event post types immediately — This eliminates the attack vector entirely by preventing the initial payload delivery. In WordPress admin: Settings → Discussion → uncheck 'Allow people to submit comments on new posts', or use WP-CLI: wp option update default_comment_status closed. For existing events: wp post list --post_type=tribe_events --format=ids | xargs -I{} wp post update {} --comment_status=closed. Deploy within the noisgate CRITICAL mitigation SLA of 3 days.
2. Deploy WAF rule blocking serialized PHP objects in comment bodies — Add a ModSecurity/Cloudflare/AWS WAF rule matching PHP serialization patterns (O:[0-9]+:", a:[0-9]+:{) in POST request bodies to /wp-comments-post.php. This catches the payload before it reaches WordPress. Deploy within 3 days.
3. Enable PHP unserialize protection via Snuffleupagus or disable_functions — If running PHP with Snuffleupagus, enable the sloppy_comparison and unserialize_hmac features to prevent arbitrary deserialization. Alternatively, if feasible, restrict dangerous PHP functions. Deploy within 3 days.
4. Apply the vendor patch (6.17.4.1) — Update The Events Calendar to 6.17.4.1 via WordPress admin or WP-CLI: wp plugin update the-events-calendar. This is the definitive fix. If auto-updates are disabled, push this manually. Target completion within the noisgate CRITICAL remediation SLA of 90 days, but realistically push for this week given the weaponized PoC.
5. Audit for indicators of compromise — Check for unexpected WordPress admin accounts, new plugin installations (especially unknown ones), webshells in wp-content/, and anomalous entries in wp-comments-post.php access logs. Review wp_users table for accounts created after 2026-09-10.

Run this script on each WordPress host or from a management server with WP-CLI access. Invoke as: bash check_cve_2026_78006.sh /var/www/html (pass the WordPress root directory as the first argument). Requires read access to the plugin directory and the WordPress database (for comment status check). No root required.

#!/usr/bin/env bash
# CVE-2026-78006 Checker — The Events Calendar Deserialization RCE
# Usage: bash check_cve_2026_78006.sh /path/to/wordpress
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

WP_ROOT="${1:?Usage: $0 /path/to/wordpress}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/the-events-calendar"
VULN_FILE="$PLUGIN_DIR/src/Tribe/Views/V2/Widgets/Service_Provider.php"

# Check if plugin exists
if [ ! -d "$PLUGIN_DIR" ]; then
  echo "NOT_APPLICABLE — The Events Calendar plugin is not installed at $PLUGIN_DIR"
  exit 0
fi

# Get plugin version from readme.txt or the-events-calendar.php
VERSION=""
if [ -f "$PLUGIN_DIR/the-events-calendar.php" ]; then
  VERSION=$(grep -i 'Version:' "$PLUGIN_DIR/the-events-calendar.php" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')
fi

if [ -z "$VERSION" ] && [ -f "$PLUGIN_DIR/readme.txt" ]; then
  VERSION=$(grep -i 'Stable tag:' "$PLUGIN_DIR/readme.txt" | head -1 | sed 's/.*Stable tag:[[:space:]]*//' | tr -d '[:space:]')
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not determine The Events Calendar version"
  exit 2
fi

echo "Detected The Events Calendar version: $VERSION"

# Version comparison function
version_lte() {
  [ "$1" = "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" ]
}

version_lt() {
  [ "$1" != "$2" ] && version_lte "$1" "$2"
}

# Fixed version is 6.17.4.1
FIXED="6.17.4.1"

if version_lt "$VERSION" "$FIXED"; then
  echo "VULNERABLE — The Events Calendar $VERSION is affected by CVE-2026-78006 (fixed in $FIXED)"
  # Additional check: are comments enabled on tribe_events?
  if command -v wp &>/dev/null && [ -f "$WP_ROOT/wp-config.php" ]; then
    COMMENT_STATUS=$(cd "$WP_ROOT" && wp option get default_comment_status --allow-root 2>/dev/null || echo "unknown")
    OPEN_EVENTS=$(cd "$WP_ROOT" && wp post list --post_type=tribe_events --comment_status=open --format=count --allow-root 2>/dev/null || echo "unknown")
    echo "  Default comment status: $COMMENT_STATUS"
    echo "  Events with comments open: $OPEN_EVENTS"
    if [ "$COMMENT_STATUS" = "closed" ] && [ "$OPEN_EVENTS" = "0" ]; then
      echo "  NOTE: Comments appear disabled — attack vector may be mitigated, but update is still required"
    else
      echo "  WARNING: Comments are enabled — site is actively exploitable"
    fi
  fi
  exit 1
else
  echo "PATCHED — The Events Calendar $VERSION is >= $FIXED"
  exit 0
fi

Sources

1. OffSeq Threat Radar — CVE-2026-78006 Advisory
2. Shenlong — Service_Provider.php Unserialize RCE PoC Analysis
3. Shenlong — The Events Calendar 6.17.4.1 Security Patch Advisory
4. Sploitus — DeadExpl0it/CVE-2026-78006-POC
5. VulDB — CVE-2026-78006 Entry
6. THREATINT — CVE-2026-78006
7. Shenlong — Arbitrary Class Instantiation via Unvalidated Template
8. WordPress.org — The Events Calendar Plugin Page