The Events Calendar plugin is vulnerable to PHP object injection that allows unauthenticated attackers to execute arbitrary code on the server. The flaw lies in the is_safe_widget_instance function, which lacks proper protection and can be bypassed because PHP’s magic methods are invoked before unserialize() runs. An attacker can supply a crafted payload that is processed during event rendering, enabling code execution with the web host’s permissions. This exploitation does not require any authentication or administrative approval and can be performed solely by submitting a malicious comment or request.

WordPress sites that have installed The Events Calendar by StellarWP up to and including version 6.17.4 are affected. The vulnerability exists in all code paths that invoke is_safe_widget_instance when rendering events. Sites that have comments enabled and visible on event pages create the specific pathway that attackers can abuse.

The CVSS score of 9.8 marks this flaw as critical, while the EPSS score of less than 1% indicates it has not been widely exploited yet. The CVE is not listed in the CISA KEV catalog, so active exploits are not documented. Attackers can send a crafted comment or visitor request that includes the malicious serialized payload; because the plugin processes comment HTML via do_blocks() during rendering, the payload is executed before any moderation. The exploit therefore requires no special privileges beyond the ability to post a comment on an event page.