The Events Calendar CVE-2026-78006 and CVE-2026-78159: Update to 6.17.4.1
Two critical vulnerabilities in The Events Calendar WordPress plugin can lead to unauthenticated remote code execution on sites that expose the affected event-comment path. CVE-2026-78006 affects versions through 6.17.4, while CVE-2026-78159 affects versions through 6.17.3. Both carry a CVSS score of 9.8.
The complete remediation point is The Events Calendar 6.17.4.1, released September 10, 2026. Wordfence disclosed the two independent vulnerability chains publicly on September 14 and recommends upgrading to the latest patched release. The plugin is active on more than 600,000 WordPress sites, according to Wordfence.
Exploitation depends on a specific configuration: comments must be enabled on event pages, including The Events Calendar's “Show comments on event pages” option. The vulnerable V2 single-event rendering path can process attacker-controlled block markup from a pending comment before moderator approval.
Affected and fixed versions
| Vulnerability | Severity | Affected versions | Individual patch | Complete remediation |
|---|---|---|---|---|
| CVE-2026-78006 | CVSS 9.8 Critical | The Events Calendar ≤ 6.17.4 | 6.17.4.1 | 6.17.4.1 or later |
| CVE-2026-78159 | CVSS 9.8 Critical | The Events Calendar ≤ 6.17.3 | 6.17.3.1 | 6.17.4.1 or later |
Operators should standardize on 6.17.4.1 or later because it closes both disclosed chains. Treating 6.17.3.1 as the target would address CVE-2026-78159 while leaving later affected builds within the CVE-2026-78006 range.
How the attack surface is exposed
The two flaws use different execution paths but share the same event-comment attack surface.
The Events Calendar's V2 single-event template buffers the rendered event page, including its comment area, and passes that output through WordPress block processing. Wordfence found that a crafted comment can therefore place attacker-controlled block markup into the plugin's widget-rendering pipeline.
WordPress supplies a moderation-preview URL that lets a commenter view a pending comment. On an affected site, that preview can reach the vulnerable rendering path before a moderator approves the comment. Wordfence therefore classifies both chains as unauthenticated: the attacker needs no WordPress account or administrator approval.
CVE-2026-78006 reaches a PHP object-injection path. Wordfence's analysis shows that the plugin's widget-instance safety check can be bypassed, allowing a malicious serialized object to reach code-execution behavior.
CVE-2026-78159 follows a separate code-injection path involving insufficient validation of a widget classes map. The resulting callable-invocation primitive can be used to reset an administrator password, after which control of the WordPress administration interface can enable malicious plugin installation and server-side code execution.
The configuration precondition matters
Both disclosed chains require comments to be enabled and visible on event pages. For The Events Calendar, that means WordPress comments must be available for the relevant tribe_events content and the plugin's own Show comments on event pages setting must be active.
That condition gives administrators a useful inventory check, but version remediation remains the durable fix. A site can later re-enable comments or change templates, and configuration drift can restore the exposed path.
For installations that cannot be upgraded immediately, disabling comments on event pages and turning off Show comments on event pages removes the shared path described in Wordfence's disclosure. This is a temporary exposure-reduction measure rather than a substitute for moving to a fixed build.
Wordfence firewall coverage dates
Wordfence says its Premium, Care and Response customers received a firewall rule covering known exploits for both vulnerabilities on August 22, 2026. The same rule is scheduled to reach users of the free Wordfence firewall on September 21, 2026.
The plugin update is the primary remediation because it fixes the vulnerable code regardless of which web application firewall is deployed. Sites relying on the free Wordfence rule should also account for the September 21 rollout date when assessing their current controls.
What administrators should do
- Inventory The Events Calendar installations and versions. Any installation at 6.17.4 or earlier falls within at least one disclosed affected range.
- Upgrade to 6.17.4.1 or a later fixed release. Verify the installed version after the update and clear application/page caches where applicable.
- Check event-comment settings. Sites awaiting an update should disable comments on event pages and the plugin's Show comments on event pages option.
- Review high-value WordPress account activity. Investigate unexpected administrator password changes, newly created privileged users, unfamiliar plugins and other unexplained administrative changes on systems that exposed the vulnerable configuration.
- Review host and application telemetry if compromise is suspected. Unexpected PHP files, plugin changes, outbound connections or process execution around the WordPress installation warrant incident-response treatment rather than a patch-only response.
Exploitation status and evidence
Wordfence's public disclosure documents validated proof-of-concept exploitation paths and the affected configuration. The reviewed primary and independent sources do not establish active exploitation in the wild as of this article's publication time.
The vulnerabilities are also absent from the CISA Known Exploited Vulnerabilities catalog version reviewed for this article. KEV absence is an exploitation-evidence boundary, not a severity reduction: both flaws provide unauthenticated paths to code execution when the required event-comment configuration is exposed.
Bottom line
WordPress operators running The Events Calendar should move to 6.17.4.1 or later. CVE-2026-78006 and CVE-2026-78159 are separate CVSS 9.8 vulnerability chains, but both originate from attacker-controlled comment content reaching the plugin's event-page widget-rendering path.
The highest-priority systems are affected versions with comments enabled on event pages. Patch those installations first, use the comment-setting change only as an interim control, and investigate unexpected administrator or plugin activity when an exposed site may have been targeted.