A visitor who never logs in leaves a comment on an event — and ends up able to run code on your server.
On September 10, 2026, the final fix landed for two critical flaws in The Events Calendar, the WordPress plugin that powers event schedules and registration pages on more than 600,000 sites (SecurityWeek, Sep 16, 2026). Tracked as CVE-2026-78006 and CVE-2026-78159, both are rated 9.8 out of 10, Critical, and both allow unauthenticated visitors to achieve remote code execution — full takeover of the WordPress installation (SecurityWeek, Sep 16, 2026; GBHackers, Sep 16, 2026). The fully patched version is 6.17.4.1. If your site publishes events and lets visitors comment on them, this is the update to prioritize and the one setting to check.
What happened
The Events Calendar renders single-event pages with a workflow that turned out to be dangerous. The plugin buffers the whole event page — including the comments area — and passes it through WordPress's do_blocks() function, which processes Gutenberg-style block markup. Normally that markup lives in post content written by an editor, not in visitor comments. But WordPress comment sanitization keeps the HTML comment delimiters that Gutenberg uses for block markup, so a wp:legacy-widget block submitted inside an event comment reaches the block parser (GBHackers, Sep 16, 2026; NVD, CVE-2026-78006).
That alone would be bad. The preview mechanism makes it worse. WordPress gives each commenter a moderation-hash URL that lets them view their own pending comment immediately. The injected block markup is therefore delivered to the vulnerable code path before any moderator reviews it — no account, no approval, no administrator interaction (NVD; SecurityWeek, Sep 16, 2026).
The two flaws then diverge into independent chains to the same outcome. CVE-2026-78006 (affecting versions through 6.17.4) breaks the is_safe_widget_instance guard: PHP fires magic methods during pre-parsing while enable_rendering_widget_copied() forges a valid wp_hash integrity attribute ahead of unserialize(), letting attacker-controlled data reach deserialization and execute code (NVD; GBHackers, Sep 16, 2026). CVE-2026-78159 (affecting versions through 6.17.3) needs no serialized objects at all: a crafted plain-array payload passes the object-safety check and reaches the CSS class handler parse_array(), where is_callable() accepts globally available function names instead of safe routines only. Researchers demonstrated using that path to invoke wp_update_user() and reset the password for administrator account ID 1 (GBHackers, Sep 16, 2026; CyberPress). Either way, the result is the same: malware deployment, data theft, administrator takeover, or complete server control (GBHackers, Sep 16, 2026).
The timeline is straightforward. Researcher Chloe Chamberland of Wordfence Argus reported both chains; vendor StellarWP acknowledged the reports on August 24 (GBHackers, Sep 16, 2026; Wordfence Intelligence, Sep 11, 2026). The first flaw, CVE-2026-78159, was patched August 25 in version 6.17.3.1; the second, CVE-2026-78006, was resolved in 6.17.4.1, released September 10 — the fully patched release for both chains (SecurityWeek, Sep 16, 2026). Wordfence published its disclosure in the week of September 11–12, followed by industry coverage including CyCognito on September 14 and SecurityWeek on September 16.
One precision matters because headlines blur it: installed does not mean reachable. Both chains require comments to be enabled and visible on event pages (the plugin's "Show comments on event pages" setting). Sites that disable commenting on the events post type, or restrict comments to logged-in users, remove the unauthenticated route even while running an affected version (NVD; SecurityWeek, Sep 16, 2026; CyCognito, Sep 14, 2026). WordPress data shows roughly 240,000 sites run plugin versions prior to 6.17 — affected by both flaws — and download counts between September 10 and 14 suggest about half of installations may still be unpatched against CVE-2026-78006 (SecurityWeek, Sep 16, 2026). The "200,000+ sites" exposure figure reflects that unpatched population, not the full 600,000 install base.
Why this matters to website owners
For a business owner, the uncomfortable part is how ordinary everything looks. Event pages — workshops, classes, fundraisers, conference registrations — are exactly the pages you want the public to find, share, and comment on. The attack arrives through that welcome mat: a comment nobody approved yet, viewed through a preview link only the commenter holds. There is no defaced homepage, no failed checkout, no alarm. The compromise is quiet, and the absence of symptoms does not mean the absence of a problem.
Three things make this pattern worse than a typical bug.
First, the exposed pages are often not the flagship site. Event calendars frequently live on microsites, regional pages, registration subdomains, or staging hostnames left publicly reachable (CyCognito, Sep 14, 2026). Those side properties get less attention than the main store — fewer updates, fewer eyes on user accounts — while carrying the same server-level consequences when compromised.
Second, the fix window is narrow and the shield is uneven. Wordfence extended firewall protection to its Premium, Care, and Response customers on August 22, but free-tier users are scheduled to receive the rule on September 21 (GBHackers, Sep 16, 2026). During the exact period when disclosure drives probing, updating is the only immediate protection for free-tier sites. A firewall rule is a shield; the patch removes the hole.
Third, proof-of-concept code for CVE-2026-78006 is already public, even though observed exploitation rates were still low at the time of writing, with an EPSS score under 1 percent (CyCognito, Sep 14, 2026). Wordfence counted 461 blocked attacks against the flaw in a single recent 24-hour window (Wordfence Intelligence, observed Sep 16, 2026) — early probing, not a peak. The pattern from similar WordPress flaws is that automation follows disclosure by days, not months.
What to do
Update The Events Calendar to 6.17.4.1 or later. This is the fix that closes both chains. In WordPress go to Dashboard → Updates, or ask the person who maintains the site to apply it and confirm the version number. The reason update comes first is that it removes the vulnerability itself — everything below is verification, not a substitute (Wordfence Intelligence; SecurityWeek, Sep 16, 2026). If the site runs Wordfence, paid tiers have had a firewall rule since August 22, but free-tier protection does not arrive until September 21 — so free-tier sites should treat patching as the only immediate defense (GBHackers, Sep 16, 2026).
Check one setting: comments on event pages. If the business does not need public comments on events, turn them off — that single change removes the unauthenticated delivery route for both chains. In the plugin settings look for "Show comments on event pages" and disable it; alternatively, disable comments on the events post type or restrict commenting to logged-in users (GBHackers, Sep 16, 2026; CyCognito, Sep 14, 2026). The reason this matters structurally is that every public input on an event page — comments today, another field tomorrow — is future attack surface. The smallest set of public inputs leaves the least room for the next validation bug.
Review administrator accounts and installed plugins for changes you did not make. Successful exploitation can create rogue admin users, install backdoors disguised as plugins, or reset the main administrator password (GBHackers, Sep 16, 2026). Ask your developer or host to list users with administrator roles and confirm each one, and to flag any plugin or file with a modification date around the exposure window. If anything unfamiliar appears, treat it as an active incident and get a focused security review rather than stopping at deletion.
Ask your host or developer to inspect logs for the attack pattern. The tell is suspicious comment submissions on event pages and requests for moderation-preview URLs — the mechanism that delivers the payload before approval (GBHackers, Sep 16, 2026). No static list of attacker addresses is published here because those rotate too fast to stay accurate; point whoever checks at the live Wordfence advisory and your own server logs instead. Matches confirm probing, but the absence of matches does not guarantee the site is clean — which is why the update and the settings check above matter more.
Key numbers
- 600,000+ active installations of The Events Calendar — SecurityWeek, Sep 16, 2026; GBHackers, Sep 16, 2026.
- CVSS 9.8 out of 10, Critical, for both CVE-2026-78006 and CVE-2026-78159 (CNA: Wordfence) — NVD; SecurityWeek, Sep 16, 2026.
- Affected: CVE-2026-78159 through 6.17.3 (fixed 6.17.3.1, Aug 25); CVE-2026-78006 through 6.17.4 (fixed 6.17.4.1, Sep 10, the fully patched release) — SecurityWeek, Sep 16, 2026.
- ~240,000 sites on versions prior to 6.17 (affected by both flaws); 300,000+ downloads Sep 10–14 suggest roughly half of installs may still be unpatched against CVE-2026-78006 — SecurityWeek, Sep 16, 2026.
- Precondition: comments enabled and visible on event pages — NVD; SecurityWeek, Sep 16, 2026; CyCognito, Sep 14, 2026.
- 461 attacks against CVE-2026-78006 blocked by Wordfence in one recent 24-hour window; proof-of-concept code public, EPSS under 1% at time of writing — Wordfence Intelligence (observed Sep 16, 2026); CyCognito, Sep 14, 2026.
- Firewall gap: paid Wordfence tiers protected Aug 22; free tier scheduled Sep 21 — GBHackers, Sep 16, 2026.
- Researcher: Chloe Chamberland, Wordfence Argus (both CVEs) — Wordfence Intelligence, Sep 11, 2026.
Final takeaway
An events calendar is hospitality infrastructure — it exists to welcome strangers. These two flaws turned the most hospitable corner of the site, the event comment box, into code execution with no login at all. The remedy is proportionate: update to 6.17.4.1, decide whether event pages truly need public comments, and verify no stranger already used the welcome mat. That is an hour of work that converts one of the highest-blast-radius WordPress exposures this month into a verified non-event.
Is your site ready? Run a free security scan — 40+ automated checks, instant results, no commitment.