CVE-2026-78159

The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation

View on CVE.org

Published Sep 12, 2026 CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Description

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

Analysis

Technical impact

The vulnerability allows an attacker to inject malicious code into the WordPress server by exploiting insufficient validation of the widget 'classes' map within The Events Calendar plugin (CWE-94). An unauthenticated user can place a specially crafted array in a comment that bypasses the is_safe_widget_instance() check and reaches the callable-invocation sink in Element_Classes::parse_array(), resulting in arbitrary code execution on the server.

Affected Systems

The vulnerability affects the The Events Calendar WordPress plugin developed by stellarwp. All releases up to and including version 6.17.3 are impacted. Sites running any of these versions are susceptible if the plugin is active on a WordPress installation.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical severity, yet the EPSS score of less than 1% suggests that exploitation has not been observed at the time of analysis. The exploit requires that the site has tribe_events posts with comments enabled and that a comment contains a crafted wp:legacy-widget block; after do_blocks() processes the single-event HTML, the malicious payload is executed. Although the vulnerability is not currently listed in CISA’s KEV catalog, the potential impact warrants immediate attention.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

stellarwp

The Events Calendar

unaffected

Version	Status	Constraints
`0`	affected	≤ 6.17.3

No data.

Vendor Product Versions

Stellarwp

The Events Calendar

Version	Status	Scheme	Platform
`[0,6.17.3]`	affected	semver	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update The Events Calendar plugin to version 6.17.4 or later.
If updating immediately is not possible, disable comments on tribe_events posts or restrict comment content to break the exploitation chain.
Search for and remove any comments that contain a crafted wp:legacy-widget block and audit existing comments for similar malicious payloads.

Generated by OpenCVE AI on September 15, 2026 at 18:32 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.4% (1.394% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211
https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214
https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279
https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30
https://plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendar
https://plugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar
https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve

History

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 13, 2026 6:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Stellarwp Stellarwp the Events Calendar Wordpress Wordpress wordpress
Vendors & Products		Stellarwp Stellarwp the Events Calendar Wordpress Wordpress wordpress

Sep 12, 2026 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
Title		The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
Weaknesses		CWE-94
References		https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211 https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214 https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279 https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30 https://plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendar https://plugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`