CVE-2026-78159: Events Calendar WordPress Plugin RCE Flaw

CVE-2026-78159 Overview

CVE-2026-78159 is a Remote Code Execution (RCE) vulnerability in The Events Calendar plugin for WordPress, affecting all versions up to and including 6.17.3. The flaw resides in the parse_array function within Element_Classes.php, where insufficient validation of the widget classes map allows a plain-array payload to bypass the is_safe_widget_instance() object check. This bypass reaches a callable-invocation sink, permitting unauthenticated attackers to execute arbitrary code on the server. The vulnerability is categorized under [CWE-94] Improper Control of Generation of Code (Code Injection).

Critical Impact
Unauthenticated attackers can achieve remote code execution on WordPress servers running vulnerable versions of The Events Calendar plugin, leading to full site compromise.

Affected Products

The Events Calendar plugin for WordPress — all versions up to and including 6.17.3
WordPress sites with comments enabled on tribe_events posts
WordPress installations processing wp:legacy-widget blocks via do_blocks()

Discovery Timeline

2026-09-12 - CVE-2026-78159 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-78159

Vulnerability Analysis

The vulnerability exists in the Element_Classes::parse_array() method of The Events Calendar plugin. This method processes widget class data but fails to properly validate the structure of the input. When a plain-array payload is supplied instead of the expected object, the is_safe_widget_instance() safety check is bypassed. Execution then reaches a callable-invocation sink, allowing attacker-controlled data to be treated as a PHP callable.

Exploitation requires two site conditions: comments must be enabled on tribe_events posts, and at least one comment containing a crafted wp:legacy-widget block must be present. The attack chain triggers when do_blocks() processes the single-event HTML that includes the comment area, invoking the vulnerable parser during page rendering.

Root Cause

The root cause is insufficient type validation of the widget classes map inside parse_array. The plugin assumes that widget instance data will be an object subject to is_safe_widget_instance() verification, but does not enforce this assumption when a plain array is supplied. This design gap allows attacker-controlled array entries to reach a function call that treats them as callables, producing arbitrary code execution.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker submits a comment containing a specially crafted wp:legacy-widget block on a tribe_events post. When any visitor loads the affected event page, WordPress calls do_blocks() on the comment content, causing the plugin's Element_Classes::parse_array() to process the malicious payload and invoke the attacker-supplied callable. Detailed source references are available in the Wordfence Vulnerability Report and the WordPress Plugin Source Code.

Detection Methods for CVE-2026-78159

Indicators of Compromise

Comments on tribe_events post types containing wp:legacy-widget block markup with unusual classes array structures
Unexpected PHP processes spawned by the web server user after event page requests
New or modified files in the WordPress wp-content directory not associated with legitimate plugin updates
Outbound network connections from the web server to unfamiliar destinations following event page views

Detection Strategies

Review WordPress comment tables (wp_comments) for entries containing <!-- wp:legacy-widget markup, particularly on tribe_events posts
Enable PHP error logging and audit for anomalous callable invocations originating from Element_Classes.php
Deploy web application firewall rules to inspect comment submissions for serialized widget block payloads

Monitoring Recommendations

Monitor web server access logs for POST requests to wp-comments-post.php targeting tribe_events posts
Alert on file integrity changes across the WordPress installation, especially in wp-content/uploads and plugin directories
Track process-creation telemetry from the web server user account for unexpected shells or scripting interpreters

How to Mitigate CVE-2026-78159

Immediate Actions Required

Update The Events Calendar plugin to a version newer than 6.17.3 that includes the fixes from changesets #3667866 and #3667867
Audit existing comments on all tribe_events posts and delete any containing wp:legacy-widget block markup
Temporarily disable comments on tribe_events post types if immediate patching is not feasible

Patch Information

The vendor addressed this issue in commits referenced by WordPress Changeset #3667866 and WordPress Changeset #3667867. Administrators should upgrade to the patched release published after version 6.17.3. Additional context is available in the Wordfence Vulnerability Report.

Workarounds

Disable comments on tribe_events post types via WordPress admin settings until the patch is applied
Restrict comment submission to authenticated users and enable moderation for all incoming comments
Deploy a web application firewall rule to block requests containing wp:legacy-widget markup in comment fields
Remove or restrict the legacy widget block from the WordPress editor allowlist for affected sites

bash

# Configuration example: disable comments on tribe_events via WP-CLI
wp post list --post_type=tribe_events --format=ids | \
  xargs -d ' ' -I % wp post update % --comment_status=closed