Wordfence’s threat intelligence team found two separate critical vulnerabilities in The Events Calendar, a WordPress plugin active on more than 600,000 sites, that let attackers execute code on your server without logging in. Wordfence identified both chains on August 21 and 22, 2026.
What happened
Both flaws start in the same place: how the plugin renders widgets inside blog comments left on event pages. The first, tracked as CVE-2026-78159, exploits a gap in the plugin’s parse_array function to run arbitrary commands on your server. The second, CVE-2026-78006, abuses how the plugin checks whether a widget is safe to load, letting an attacker reset an administrator’s password and then upload a malicious plugin to take over the site completely.
Neither attack needs a login, an account, or any social engineering. The only requirement is that the target event page has comments enabled, using The Events Calendar’s own “Show comments on event pages” setting. Both attacks work through WordPress’s pending-comment preview, so a comment doesn’t even need to be approved to trigger them. Wordfence says a successful attack can lead to full site takeover, stolen data, and malware planted on the server.
The two chains affect The Events Calendar version 6.17.4 and earlier. Wordfence Premium, Care, and Response users received a firewall rule blocking known exploit attempts on August 22, 2026. Free Wordfence users get the same protection 30 days later.
What to do
- Update The Events Calendar to version 6.17.5 or later from your WordPress dashboard now.
- If you don’t need comments on event pages, turn off “Show comments on event pages” in the plugin’s settings as an extra layer of protection.
- If you’re on Wordfence Premium, Care, or Response, you’ve had a firewall rule since August 22. Free Wordfence users are covered from roughly September 21.
- If your site allowed event comments and ran an outdated version, check for unexpected admin accounts and unfamiliar plugins installed since late August.
End of article