The vulnerability allows an attacker to inject malicious code into the WordPress server by exploiting insufficient validation of the widget 'classes' map within The Events Calendar plugin. An unauthenticated user can place a specially crafted array in a comment that bypasses the is_safe_widget_instance() check and reaches the callable-invocation sink in Element_Classes::parse_array(), resulting in arbitrary code execution on the server.

The affected product is The Events Calendar for WordPress, supplied by stellarwp. All versions up to and including 6.17.3 are vulnerable; any WordPress site running these versions must be considered at risk.

The CVSS score of 9.8 indicates a critical severity, yet the EPSS score of less than 1% suggests that exploitation has not been observed at the time of analysis. The exploit requires that the site has tribe_events posts with comments enabled and that a comment contains a crafted wp:legacy-widget block; after do_blocks() processes the single-event HTML, the malicious payload is executed. Although the vulnerability is not currently listed in CISA’s KEV catalog, the potential impact warrants immediate attention.