Two Critical Flaws in The Events Calendar Plugin Put 200,000 WordPress Sites at Risk
Anyone can exploit the bugs without logging in, and a successful attack hands full control of a website to the attacker. Patches exist, but roughly half of all installations may not have them yet.
Key points
- Two critical flaws in The Events Calendar WordPress plugin, both scored 9.8 out of 10 in severity, allow attackers to run their own code on a vulnerable website without needing a password.
- StellarWP patched the first bug on 25 August 2026 in version 6.17.3.1, and the second on 10 September 2026 in version 6.17.4.1.
- Approximately 240,000 websites still ran a version older than 6.17 as of mid-September 2026.
- Both flaws only work if the site has comments enabled on event pages, which limits the pool of exposed sites but does not make either bug low-risk.
The Events Calendar is one of the most widely used plugins, meaning small add-on programmes, for WordPress, the content management system that powers a large share of websites worldwide. Over 600,000 sites have it installed. Two freshly disclosed flaws mean that any one of those sites with comments switched on could be taken over by a stranger on the internet, no account required.
Security firm Defiant, which researches WordPress vulnerabilities, describes both bugs as remote code execution flaws. Remote code execution, usually shortened to RCE, means an attacker can send instructions to the server and the server follows them, as if the attacker were a trusted administrator. It's the same class of flaw we reported in the GiveWP donation plugin on 28 August, which also carried a 9.8 severity score.
How did attackers get in?
Neither flaw requires the attacker to log in first. That makes them especially dangerous.
The first, CVE-2026-78159, is a code injection flaw. Code injection means slipping malicious instructions into data the site is already processing. An attacker crafts a specially shaped payload and submits it through the comment area of an event page. It runs before the plugin's defences can stop it.
The second, CVE-2026-78006, is a PHP object injection flaw. PHP is the programming language most WordPress sites run on; object injection is a technique where an attacker smuggles a disguised bundle of code into the application by hiding it inside data the site expects to receive. The critical detail is timing: the malicious comment reaches the vulnerable part of the plugin before a moderator can review or delete it.
Both flaws carry a CVSS score of 9.8, where 10 is the maximum. CVSS, the Common Vulnerability Scoring System, is the standard numerical scale researchers use to rate how serious a flaw is.
| Detail | CVE-2026-78159 | CVE-2026-78006 |
|---|---|---|
| Type | Code injection | PHP object injection |
| Authentication needed | None | None |
| CVSS score | 9.8 | 9.8 |
| Patched in version | 6.17.3.1 | 6.17.4.1 |
| Patch released | 25 August 2026 | 10 September 2026 |
Should website owners be worried?
Yes, if their site runs an older version of the plugin and has event comments turned on.
About 240,000 sites were still on a version older than 6.17 as of mid-September 2026. In the four days between 10 and 14 September, the plugin was downloaded just over 300,000 times, suggesting around half of all installations may not yet carry the patch for the later fix. Defiant reported these figures; SecurityWeek first published the wider vulnerability details.
A compromised site can be redirected to serve malware, used to steal visitor data, or quietly enlisted into a botnet, a network of hijacked machines used to attack other targets.
What should WordPress site owners do?
Update immediately. Log into your WordPress dashboard, go to the Plugins section, and install version 6.17.4.1 or later. That single version covers both flaws.
While you're there, check whether comments are enabled on event pages. Disabling comments removes the attack surface for both bugs, but it is not a substitute for patching.
If you suspect your site was already targeted, check your server logs, the records of every request made to your website, for unusual activity around event pages, particularly in the comment submission area. A website security scanner or a managed WordPress hosting provider can help if reading raw logs feels daunting.
