An unapproved comment triggers RCE in The Events Calendar before moderation sees it
StellarWP split the fix across two releases, so a WordPress site updated on August 25 stayed open to CVE-2026-78006 until 6.17.4.1 shipped on September 10. Version data puts about 240,000 installs behind both bugs.
The Watch · Security desk
What happened
- CVE-2026-78006 is an unauthenticated PHP object injection bug that can be exploited only where comments on events are enabled and visible.
- WordPress data shows about 240,000 sites running builds older than 6.17, which are affected by both vulnerabilities, out of more than 600,000 active installations.
- The plugin was downloaded just over 300,000 times between September 10 and 14, which SecurityWeek says suggests roughly half of installations may still be affected by CVE-2026-78006.
Why it matters
- Who has to decide decision A patch check that stops at 6.17.3.1, or at the August 25 date, will pass sites that are still open to the object injection bug. The version to confirm on every host is 6.17.4.1.
- Who's exposed exposure Any site on a pre-6.17.4.1 build with event comments visible is reachable by an anonymous request. That request needs no login and no approved comment to get code running.
- What it limits constraint The stopgap available to a site that cannot update tonight is switching event comments off, which drops comment functionality on every event page until the plugin is upgraded.
- What doesn't add up contradiction The two exposure estimates in the reporting measure different things: version telemetry gives about 40 percent behind on both bugs, a five-day download count gives roughly half still open to the newer one, and the comment setting that decides reachability sits outside both.
Next story · Security · 4d ago
Bricksforge's unauthenticated upload flaw is being used to run PHP on WordPress sitesConfirmed3 publishers
CVE-2026-78006 is a PHP object injection bug that fires before a human ever sees the comment. An unauthenticated visitor submits the payload, the plugin hands it to the vulnerable function, and the code runs ahead of moderation [6]. Approval comes afterward, once the code has already run. Defiant, the WordPress security firm whose analysis SecurityWeek cites, says the two flaws are independent exploitation chains and each one ends in remote code execution and complete compromise of the WordPress installation [7][10].
The other route runs through validation. CVE-2026-78159 lets an attacker inject a plain-array payload that bypasses checks and executes during the processing of single-event HTML, including the comment area [4]. StellarWP closed that one in version 6.17.3.1 on August 25 [18]. The object injection bug stayed open another 16 days, until 6.17.4.1 shipped on September 10 [19][14].
WordPress version data puts about 240,000 sites on builds older than 6.17 [12]. Against more than 600,000 active installs, that is roughly 40 percent of the base carrying both bugs [1][15]. The figure for the second bug alone is softer. Just over 300,000 downloads across the five days from September 10 to 14 works out to about half the install base [13][17][16], and SecurityWeek presents it as a suggestion that roughly half of installations may still be affected by CVE-2026-78006 [13]. Download counters record fetches, including new installs and repeated pulls from the same site.
How many sites an attacker can actually reach is a different question. SecurityWeek says it is unclear how many are vulnerable, because exploitation of both defects requires that comments are enabled in the plugin [8]. The report from SecurityWeek does not mention exploitation attempts against either CVE [9]. Version strings are all WordPress.org publishes, and the comment setting on any given site sits outside that data.
What to watch
- Blocked-attempt counts from Defiant against either CVE would move this from patch hygiene to an active campaign.
- A public proof of concept for the plain-array payload path in CVE-2026-78159.
- Later September download figures showing whether the pre-6.17 population falls below 240,000.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption60
- Hype gap+20
- Incentives40
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Events Calendar has over 600,000 active installations and lets administrators create and manage an events calendar on their websites.
- [2]
All plugin versions before 6.17.3.1 are affected by two code injection bugs that could lead to remote code execution.
- [3]
CVE-2026-78159 has a CVSS score of 9.8 and is described as an unauthenticated code injection caused by insufficient validation.
- [4]
Under certain conditions, an attacker can inject a plain-array payload that bypasses checks and executes during the processing of single-event HTML, including the comment area.
- [5]
CVE-2026-78006 has a CVSS score of 9.8 and is described as an unauthenticated PHP object injection issue that can be exploited if comments on events are enabled and visible.
- [6]
Insufficient protections in a plugin function can be bypassed by a commenter without authentication or approval, because the injected code is delivered to the vulnerable function before moderation occurs.
- [7]
The two weaknesses are independent exploitation chains, but both lead to remote code execution and the complete compromise of the WordPress installation.
- [8]
It is unclear how many WordPress sites are vulnerable, as the exploitation of both critical defects requires that comments are enabled in the plugin.
- [9]
SecurityWeek's report on the two vulnerabilities does not mention any exploitation attempts against either CVE.
- [10]
Defiant is a WordPress security firm, and its explanation of the two bugs is the basis of the report.
- [11]
More than 200,000 WordPress websites are potentially exposed to takeover attacks via two critical-severity vulnerabilities in The Events Calendar plugin.
- [12]
WordPress data shows approximately 240,000 websites use The Events Calendar versions prior to 6.17, meaning they are affected by both vulnerabilities.
- [13]
Between September 10 and 14 the plugin was downloaded just over 300,000 times, which suggests that roughly half of its installations may still be affected by CVE-2026-78006.
- [14]
The gap between the August 25 release of 6.17.3.1 and the September 10 release of 6.17.4.1 is 16 days.
- [15]
About 240,000 affected installs is roughly 40 percent of the plugin's 600,000-plus active installations.
- [16]
Just over 300,000 downloads against more than 600,000 active installs is about half the install base.
- [17]
The download window from September 10 to September 14 spans five days.
- [18]
StellarWP, The Events Calendar's developer, patched CVE-2026-78159 on August 25 in version 6.17.3.1 of the plugin.
- [19]
StellarWP resolved the second flaw in The Events Calendar version 6.17.4.1, released on September 10.
Sources
2 independent publishers whose own reporting we read for this story.
- scworld.comFlaws in The Events Calendar WordPress plugin enable unauthenticated RCE
1 article · September 17, 2026
- securityweek.comUnauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
1 article · September 16, 2026
Topics and entities
Topics
- Vulnerability Disclosure
- Remote Code Execution Surfaces
- PHP Deserialization and Gadget Chains
- WordPress Plugin Security