Unauthenticated PHP object injection to RCE in The Events Calendar WordPress plugin (CVE-2026-78006)
VulnCheck added this flaw to its KEV catalog on 2026-09-12 and a public exploit is available in VulnCheck XDB, so any site still on 6.17.4 or earlier can be taken over by an unauthenticated attacker who picks up that exploit.
The plugin's V2 widget-rendering pipeline lets an unauthenticated request reach unserialize(): enable_rendering_widget_copied() forges a valid wp_hash integrity attribute and the is_safe_widget_instance() guard is bypassed because PHP fires magic methods during pre-parse. The result is code execution on the web server for any site running 6.17.4 or earlier; the plugin is active on more than 600,000 sites.
Affected: The Events Calendar (WordPress plugin) <= 6.17.4
How to Test
Check the installed plugin version on the WordPress Plugins page (or with `wp plugin list`); anything at or below 6.17.4 is vulnerable. To look for compromise, review web server logs for unauthenticated requests hitting the plugin's V2 widget-rendering paths, and inspect the site for unexpected PHP files, modified plugin/theme files, new administrator accounts, or scheduled tasks created since early September.
How to Patch
Update The Events Calendar to 6.17.4.1 (the patched release identified by Patchstack). If the update cannot be applied immediately, deactivate the plugin until it can.