Wordfence finds two unauthenticated RCE chains in The Events Calendar WordPress plugin

What happened

Wordfence's Argus team has disclosed two critical vulnerability chains in The Events Calendar, a widely used WordPress plugin for publishing events. Both flaws, tracked as CVE-2026-78006 and CVE-2026-78159, carry a CVSS score of 9.8 and let an attacker with no account on the site achieve remote code execution. SecurityWeek reports that more than 200,000 sites could be exposed.

According to the Wordfence analysis, summarized in a dev.to write-up, the root problem is that the plugin renders comments as Gutenberg blocks even when those comments are still unapproved. When a commenter opens the preview of their own pending comment, the plugin processes blocks across the whole page, including markup the commenter supplied.

The first chain: object injection to OS commands

CVE-2026-78006 starts with an anonymous comment posted to an event page, containing a crafted wp:legacy-widget block. Opening the preview URL for that unapproved comment, which includes a moderation hash the commenter can obtain, triggers the block-rendering routine.

Inside the widget-handling code, an initial unserialize() call fails because the payload ends with deliberately malformed data. Since contains_object(false) concludes that no object is present, the is_safe_widget_instance() check lets the data through. The plugin then computes a valid wp_hash() over the attacker-controlled value and passes it to a second deserialization stage. Object restoration begins there before hitting the malformed tail, and along the way an array_map() callback in existing code executes operating system commands with the web server's privileges.

The second chain: function calls to admin takeover

CVE-2026-78159 abuses the same comment preview path differently. The attacker supplies an ordinary PHP array with no objects inside, so it passes the object checks and receives a valid hash. An extract() call in the template creates a local variable from the attacker's input, and parse_array(), fed by tec_classes(), ends up invoking functions that satisfy PHP's is_callable() test, which only verifies callability rather than safety.

Wordfence's public proof of concept uses this primitive to call wp_update_user() and reset the administrator password. The attacker then logs in as administrator, installs a malicious plugin, and reaches remote code execution from there. No credentials and no moderator approval are needed at any stage of the chain.

Requirements, detection and fixes

The write-up lists the conditions for exploitation. Affected versions are 6.17.4 and earlier for CVE-2026-78006, and 6.17.3 and earlier for CVE-2026-78159. The target event page must have comment submission and display enabled, and the attacker must be able to load the preview URL of their own pending comment. Updating to 6.17.4.1 or later patches both issues, and turning off comments on events removes the prerequisites for the disclosed attack paths.

For defenders, the report points to several indicators: POST requests submitting comments to event pages followed immediately by GET requests containing the moderation hash; shell processes such as sh, bash or cmd spawned from PHP-FPM or Apache; new or modified PHP files in the web root; and, for the second chain, administrator password changes, anomalous logins and unexpected plugin installations.

Neither Wordfence nor SecurityWeek reports active exploitation. The chains were verified in a research environment, and the write-up stresses that a crafted comment or preview request alone does not prove successful compromise.

Why it matters

Unauthenticated RCE with a 9.8 severity rating in a plugin running on hundreds of thousands of sites is about as urgent as WordPress vulnerabilities get, especially with a public proof of concept available for one chain. The bugs also carry a broader design lesson: WordPress's block renderer and its serialization helpers made assumptions, such as trusting an object check on data that fails to fully deserialize, and treating is_callable() as a safety filter, that broke down when unapproved user content reached privileged code paths. Site owners running The Events Calendar should update to 6.17.4.1 or later and, if comments on events are unnecessary, disable them outright.