CVE-2026-78006: The Events Calendar WordPress Plugin RCE

CVE-2026-78006 Overview

CVE-2026-78006 is an unauthenticated Remote Code Execution (RCE) vulnerability in The Events Calendar plugin for WordPress, affecting all versions up to and including 6.17.4. The flaw resides in the is_safe_widget_instance function, whose deserialization guardrails can be bypassed because PHP fires magic methods during pre-parse. When combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute, attacker-controlled data reaches unserialize(). The plugin's V2 single-event template calls do_blocks() over buffered comment HTML, enabling unauthenticated commenters to trigger the code path via a moderation-hash URL. The weakness maps to CWE-502: Deserialization of Untrusted Data.

Critical Impact
Unauthenticated attackers can execute arbitrary PHP code on WordPress servers running vulnerable versions of The Events Calendar when comments are enabled and visible on events.

Affected Products

The Events Calendar plugin for WordPress, all versions up to and including 6.17.4
WordPress sites with comments enabled and visible on event pages
Deployments using the V2 single-event template rendering path

Discovery Timeline

2026-09-12 - CVE-2026-78006 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-78006

Vulnerability Analysis

The vulnerability is an insecure deserialization flaw that yields unauthenticated remote code execution. The is_safe_widget_instance function attempts to validate serialized widget payloads before passing them to unserialize(). However, PHP invokes magic methods such as __wakeup and __destruct during its pre-parse stage, allowing gadget chains to execute before validation completes.

A second weakness in enable_rendering_widget_copied() forges a valid wp_hash integrity attribute, satisfying the integrity check that would otherwise reject attacker-supplied serialized data. Together, these conditions let a network attacker deliver an object graph that executes arbitrary code once processed. Refer to the Wordfence Vulnerability Analysis for a full write-up.

Root Cause

The root cause is untrusted input reaching unserialize() without effective isolation. The is_safe_widget_instance allow-list check is defeated by PHP's own parser behavior, and the forged hash bypasses the secondary integrity gate. Relevant code paths are visible in the Service Provider Widget Code and the Template Bootstrap Code.

Attack Vector

An unauthenticated attacker submits a comment on an event containing crafted block markup with a serialized widget payload. WordPress returns a moderation-hash URL that permits the commenter to immediately view their own pending comment. Loading that URL invokes do_blocks() over the buffered comment HTML on the V2 single-event template, delivering the payload to the vulnerable deserialization path before any moderator intervenes. Exploitation requires only that comments be enabled and visible on events. No verified exploit code has been published; see the Wordfence Vulnerability Analysis for further technical detail.

Detection Methods for CVE-2026-78006

Indicators of Compromise

Anonymous POST requests to wp-comments-post.php on event URLs followed by immediate GET requests containing moderation-hash or unapproved query parameters.
Comment content containing WordPress block markers such as <!-- wp: combined with serialized PHP payload patterns like O: or a: object descriptors.
Unexpected outbound network connections, new PHP files under wp-content/, or modifications to plugin and theme files following event-page traffic.
Web shell artifacts or scheduled tasks created by the web server user on hosts running The Events Calendar.

Detection Strategies

Inspect access logs for the pattern of an unauthenticated comment submission immediately followed by a moderation-hash preview request on the same event URL.
Alert on HTTP request bodies to event endpoints that include serialized PHP object markers within comment fields.
Correlate PHP error logs mentioning unserialize(), __wakeup, or __destruct with recent event-page comment activity.

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and the the-events-calendar plugin directory.
Forward WordPress, PHP-FPM, and web server logs to a centralized SIEM and retain them for retrospective analysis.
Monitor process creation from the web server account for unexpected shells or interpreters spawned by PHP.

How to Mitigate CVE-2026-78006

Immediate Actions Required

Update The Events Calendar to a version newer than 6.17.4 as soon as the vendor patch is available.
Disable comments on events, or hide comments from the V2 single-event template, if patching cannot be performed immediately.
Audit event pages and the WordPress installation for signs of compromise, including unfamiliar administrator accounts and unexpected PHP files.
Rotate WordPress secrets in wp-config.php and reset administrator credentials if compromise is suspected.

Patch Information

The vendor fix is tracked in the WordPress Events Calendar Changeset. Administrators should apply the patched release through the WordPress plugin updater and verify the installed version is above 6.17.4.

Workarounds

Disable the comment feature on the Events post type until the plugin is updated.
Deploy a Web Application Firewall (WAF) rule that blocks comment submissions containing serialized PHP object markers such as O: and a: alongside WordPress block delimiters.
Restrict access to event pages that expose comments to authenticated users only, using access controls at the reverse proxy.

bash

# Example WAF rule concept (ModSecurity) to block serialized PHP payloads in comment fields
SecRule ARGS:comment "@rx (O|a):[0-9]+:\{" \
    "id:1026078006,phase:2,deny,status:403,\
    msg:'Potential CVE-2026-78006 exploit: serialized PHP in comment'"