Description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
Published: 2026-09-12
Score: 9.8 Critical
EPSS: 1.4% Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability allows an attacker to inject malicious code into the WordPress server by exploiting insufficient validation of the widget 'classes' map within The Events Calendar plugin (CWE-94). An unauthenticated user can place a specially crafted array in a comment that bypasses the is_safe_widget_instance() check and reaches the callable-invocation sink in Element_Classes::parse_array(), resulting in arbitrary code execution on the server.

Affected Systems

The vulnerability affects the The Events Calendar WordPress plugin developed by stellarwp. All releases up to and including version 6.17.3 are impacted. Sites running any of these versions are susceptible if the plugin is active on a WordPress installation.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, yet the EPSS score of less than 1% suggests that exploitation has not been observed at the time of analysis. The exploit requires that the site has tribe_events posts with comments enabled and that a comment contains a crafted wp:legacy-widget block; after do_blocks() processes the single-event HTML, the malicious payload is executed. Although the vulnerability is not currently listed in CISA’s KEV catalog, the potential impact warrants immediate attention.

Generated by OpenCVE AI on September 15, 2026 at 18:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update The Events Calendar plugin to version 6.17.4 or later.
  • If updating immediately is not possible, disable comments on tribe_events posts or restrict comment content to break the exploitation chain.
  • Search for and remove any comments that contain a crafted wp:legacy-widget block and audit existing comments for similar malicious payloads.

Generated by OpenCVE AI on September 15, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
First Time appeared Stellarwp
Stellarwp the Events Calendar
Wordpress
Wordpress wordpress
Vendors & Products Stellarwp
Stellarwp the Events Calendar
Wordpress
Wordpress wordpress

Sat, 12 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
Title The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Stellarwp The Events Calendar
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-14T16:10:33.540Z

Reserved: 2026-08-23T11:39:39.155Z

Link: CVE-2026-78159

cve-icon Vulnrichment

Updated: 2026-09-14T16:10:29.880Z

cve-icon NVD

Status : Deferred

Published: 2026-09-12T08:16:24.377

Modified: 2026-09-14T17:17:51.410

Link: CVE-2026-78159

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T18:45:18Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')