Exploitation observed; activity peaked at 7 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-12 | 4 | Disclosure4 |
| 2026-09-13 | 4 | Disclosure1Patch2PoC1 |
| 2026-09-14 | 2 | Disclosure1Patch1 |
| 2026-09-15 | 7 | Active Exploitation4Disclosure1Patch2 |
| 2026-09-16 | 6 | Active Exploitation2Patch4 |
| 2026-09-17 | 4 | Active Exploitation1Patch3 |
| 2026-09-24 | 1 | Patch1 |
CVE-2026-78006, WordPress The Events Calendar eklentisindeki unauthenticated Remote Code Execution (RCE) açığı için PoC yayınlandı: https://github.com/DeadExpl0it/CVE-2026-78006-POC
Post summary
A PoC demonstrating an unauthenticated RCE in WordPress The Events Calendar plugin (CVE-2026-78006) has been published on GitHub.
CVE-2026-78006 & CVE-2026-78159: Two unauthenticated vulnerability chains leading to RCE in The Events Calendar Plugin for WordPress, 9.8 Rating 🔥 Two critical vulnerabilities were recently disclosed in The Events Calendar Plugin for WordPress. The first uses PHP Object Injection to execute arbitrary OS commands on the underlying server. The second allows an unauthenticated attacker to reset an administrator’s password, after which the attacker can upload a malicious plugin and take complete control of the site. The first vulnerability (CVE-2026-78006) is already being exploited in the wild! 👉 https://nt.ls/mEm8O
Post summary
The tweet discloses two critical unauthenticated RCE flaws in The Events Calendar WordPress plugin, notes that CVE-2026-78006 is already being exploited in the wild, and provides technical details but no patch or exploit code.
Two unauthenticated RCEs were just disclosed in "The Events Calendar", a WordPress plugin with more than 600,000 active installs. They are tracked as CVE-2026-78159 and CVE-2026-78006, they are both scored 9.8 on the CVSS score and can both lead to a full site takeover. About 200,000 sites are estimated to be vulnerable. I have seen this kind of bug before. During a client pentest, I found an unauthenticated SQL injection in FlipperCode’s Custom CSS, JS & PHP plugin. I was able to chain it all the way to remote code execution. That vulnerability became CVE-2026-6433. It was unauthenticated, meaning no admin or user credentials were needed and If the plugin was installed on a website, I could have a shell on the host. This is the same pattern, just on a much bigger plugin. A lot of organisations treat the company website as a marketing page. It is also an internet-facing application, running plugins written by people you have never met. For a bank, a hospital, a fintech, or a capital-markets operator here, that site is part of the same attack surface as everything else you are trying to protect. A scanner will not find a zero-day that is yet to be disclosed. However, an experienced pentester knows when to look under the hood and find a bug that others will ignore, just like a motivated attacker would. If you run WordPress, check whether The Events Calendar is installed. If it is, please update it to 6.17.4.1 or later. Also, do not wait for the next advisory. Have your website tested the way an attacker would. At @clarensecltd we include in-depth WordPress reviews in our assessments. You can send a message to info@clarensec.com or visit https://clarensec.com/contact hashtag#WordPress hashtag#CyberSecurity hashtag#VAPT
Post summary
The post discloses two critical unauthenticated RCE vulnerabilities (CVE-2026-78159, CVE-2026-78006) in The Events Calendar WordPress plugin and urges immediate update to version 6.17.4.1 or later, while promoting the author's security assessment services.
🔴 WordPress The Events Calendar eklentisinde iki kritik RCE açığı: CVE-2026-78159 ve CVE-2026-78006 (CVSS 9.8) Kimlik doğrulama gerektirmeden özel hazırlanmış bir payload ile kod enjeksiyonu ve uzaktan kod çalıştırmaya (RCE) yol açabiliyor. CVE-2026-78159 — Unauthenticated Code Injection -> RCE CVE-2026-78006 — Unauthenticated PHP Object Injection -> RCE Etkilenen sürüm: 6.17.4.1 öncesi sürümler Güncel sürüm: 6.17.4.1+ The Events Calendar kullanan WordPress siteleri mutlaka eklentiyi güncellemeli. https://wordpress.org/plugins/the-events-calendar/
Post summary
The post announces two critical RCE vulnerabilities (CVE‑2026‑78159 and CVE‑2026‑78006) in The Events Calendar WordPress plugin, advises immediate update to version 6.17.4.1+, and details their technical characteristics.
WordPressの人気プラグイン「The Events Calendar」。 認証不要でRCEです。 CVE-2026-78006、6.17.4以下が対象。 しかも、コメント欄が有効だと攻撃の入口になります。 【対象か3問で確認】 ① WordPressサイトか？ ② The Events Calendarが入っているか？ ③ バージョンが6.17.4以下か？ ③がYesなら、今すぐ更新。 更新できない間は、 設定 → ディスカッション → 「新しい投稿へのコメントを許可する」をオフ。 自動更新になっていない環境なら、結局は人が気づいて対応するしかない。 日曜日の夜に、こういう対応は正直疲れる。 でも、認証不要RCEは放置できない。 #WordPress #WordPressセキュリティ #CVE_2026_78006 #サイバーセキュリティ
Post summary
Announces CVE-2026-78006 as an auth-unrequired RCE in The Events Calendar plugin (≤6.17.4), urges immediate update, and provides a temporary workaround of disabling comments.
【The Events Calendar - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation】 WordPress The Events Calendar プラグインに2つの重大なRCE脆弱性：CVE-2026-78159 および CVE-2026-78006 (CVSS 9.8) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/the-events-calendar/the-events-calendar-6173-unauthenticated-code-injection-to-remote-code-execution-via-widget-classes-map-callable-invocation
Post summary
The text announces two critical RCE vulnerabilities (CVE-2026-78159 and CVE-2026-78006, CVSS 9.8) in WordPress The Events Calendar plugin with specific technical details, but contains no PoC, exploit code, active exploitation claims, or patch information. This is an initial vulnerability disclosure linking to a Wordfence advisory.
Threat actors are exploiting critical WordPress plugin vulnerabilities to upload PHP web shells and achieve unauthenticated remote code execution. - WooCommerce Wholesale Lead Capture CVE-2026-27540 enables arbitrary file uploads through the wwlc_file_upload_handler AJAX action; more than 100,000 exploit attempts have been blocked since June 2026. - Observed shell.php payloads report host details and provide a browser-based mechanism to upload additional files. - Two The Events Calendar flaws, CVE-2026-78159 and CVE-2026-78006, enable remote code execution through pending-comment previews and can result in administrator password reset, malicious plugin upload, data theft, or full site takeover. - Site owners should patch affected plugins and inspect uploads directories and suspicious admin-ajax.php requests. VULNERABILITY CVE-2026-27540 CVE-2026-78006 CVE-2026-78159 INDICATOR 104.194.9.138 114.10.43.203 187.75.114.36 23.137.105.214 23.180.120.140 31.59.129.150 37.114.144.209 92.241.13.140 92.241.13.213 ipv6:2a0f:85c1:840:5389::1 Get free accont on threatlandscape io
Post summary
The text reports active exploitation of critical WordPress plugin vulnerabilities, including WooCommerce Wholesale Lead Capture (CVE-2026-27540) and The Events Calendar flaws (CVE-2026-78159, CVE-2026-78006), with over 100,000 exploit attempts blocked and web shells observed in the wild, urging site owners to patch and inspect their systems.
Good morning. 🌅 An unapproved blog comment just got 600,000+ WordPress sites full remote code execution. Nobody has to click [approve] the attacker previewing their OWN pending comment is the entire attack. CVE-2026-78006, disclosed in the last 24 hours. Update The Events Calendar now.
Post summary
The text discloses CVE-2026-78006 as a WordPress/The Events Calendar remote code execution issue and emphasizes updating the plugin. No PoC, named exploit tool, or active exploitation claim is provided.
Two unauthenticated critical vulnerability chains in The Events Calendar WordPress plugin enable remote compromise of affected websites. - CVE-2026-78006 uses PHP object injection, bypassed deserialization checks, and a gadget chain to execute operating-system commands. - CVE-2026-78159 abuses arbitrary callable execution to invoke wp_update_user(), reset the administrator account password, and enable malicious plugin installation. - Exploitation can be triggered through crafted Gutenberg markup in unapproved event-page comments and moderation-preview URLs, without comment approval. - Administrators should update to version 6.17.4.1 or later, disable unnecessary event-page comments, review accounts and plugins, and investigate suspicious comment and preview activity. VULNERABILITY CVE-2026-78006 CVE-2026-78159
Post summary
The text discloses two critical CVEs in The Events Calendar WordPress plugin, explains their technical details, and emphasizes updating to version 6.17.4.1 as remediation, with strong confidence in the patch recommendation.
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 15, 2026 1️⃣ CISCO PATCHES CRITICAL ZERO-DAY IN SECURE EMAIL GATEWAY Cisco fixed a zero-day in the AsyncOS platform that powers its Secure Email Gateway — CVE-2026-76461, rated CVSS 9.8 — where a single crafted email triggers a SQL injection that escalates straight to root-level remote code execution. No credentials, no user interaction, zero prerequisites: the message itself is the payload. CISA has added it to the Known Exploited Vulnerabilities catalog, so affected appliances should be patched and mail logs reviewed rather than assumed clean. 🔹 @ThreatAft 2️⃣ CISA: vCENTER RCE NOW IN RANSOMWARE GANGS' TOOLKIT CISA updated its Known Exploited Vulnerabilities list to flag VMware vCenter CVE-2026-59310 — a critical, unauthenticated remote code execution via Syslog path traversal that had been patched back in July 2026. What changed is the abuse: ransomware crews are now actively exploiting it, after the flaw already saw APT reverse-SSH campaigns across dozens of countries. If you run vCenter, treat this as an emergency patch-and-exposure check, and keep the management interface off the public internet. 🔹 @Orion84x 3️⃣ COSTA RICA INVESTIGATES DARK WEB SALE OF TENS OF MILLIONS OF RECORDS Costa Rica's National Cybersecurity Directorate is investigating a dark web post claiming to sell tens of millions of records tied to people in Costa Rica — including identity card photos, court files, vehicle registrations, and salary data. If the claim holds up, it would be one of the larger national-scale identity dumps in recent memory, and the mix of ID photos with court and income data makes it a serious fraud and identity-theft pipeline. 🔹 @NIKSUN 4️⃣ OPEN SOURCE GROWTHBOOK FLAW LEAKS DATA WAREHOUSE SQL A newly disclosed high-severity flaw (CVE-2026-91198) in GrowthBook — the popular open source feature-flagging platform, versions 5.0.1 and below — lets an unauthenticated attacker reach the SQL sitting behind an organization's data warehouse. It is not direct database access, but it is close enough to expose the queries and structure behind your feature data. If GrowthBook is part of your stack, upgrade past 5.0.1. 🔹 @XQOPTRX 5️⃣ WORDPRESS EVENTS CALENDAR: TWO UNAUTH RCE CHAINS ON ~600K SITES The Events Calendar WordPress plugin is hit with two unauthenticated remote code execution flaws — CVE-2026-78006 and CVE-2026-78159, both around CVSS 9.8. The attack path runs from a comment into a widget, yielding PHP object injection RCE, or an admin password reset without any login when event comments are enabled. With roughly 600,000 sites on the plugin, this is a fast route to mass scanning and mass compromise. 🔹 @Orion84x 6️⃣ VOICEBOX: LOCAL OPEN-SOURCE ALTERNATIVE TO ELEVENLABS A new open source project called Voicebox — already past 53,000 GitHub stars under an MIT license — is being pitched as a local alternative to ElevenLabs and WisprFlow. You give it a short clip of your voice, it clones how you sound, and any AI agent connected to it can speak in that voice — all on your own hardware. For teams that want voice cloning without shipping recordings to a third-party cloud, it is a meaningful option. 🔹 @HelloVyom 7️⃣ NOFIRE OPEN-SOURCES BRIG: microVM SANDBOX FOR AI CODING AGENTS NOFire has open-sourced Brig, a microVM sandbox (Apache 2.0) that runs AI coding agents in hardware-enforced isolation on Mac or Linux. The goal is containment by default: an auto-approved agent's package installs and credential use are locked inside a microVM instead of owning the whole machine. As agents get more autonomy, cheap isolation layers like this are becoming a real security primitive, not a nice-to-have. 🔹 @BadSignalAI 8️⃣ DELAWARE ENACTS AUTOMATED DECISION OPT-OUT RIGHT Delaware has signed a data-privacy update that gives people an opt-out right for automated decision-making and broadens the overall reach of the state's privacy law. It is a small but directional signal: automated-decision opt-outs are moving from enterprise policy into statute, and more jurisdictions are likely to follow. 🔹 @kuriharan 💭 The common thread this morning is that patching alone is no longer the defense — exploitation is. Cisco, vCenter, and WordPress are all patchable, and all are being exploited in the wild anyway. Meanwhile the open source world is quietly shipping the counter-moves: a sandboxed runtime for autonomous agents, and local voice tools that keep your biometrics on your own hardware. The gap between exploit speed and patch speed is where security actually lives now, and tools like Brig are what help close it. Which of these hits closest to home — do you run vCenter, or is GrowthBook part of your stack? Tell me your biggest patching headache below 👇 #CyberSecurity #OpenSource #Privacy #DataBreach #CVE
Post summary
The roundup's dominant signal is active exploitation: CVE-2026-76461 and CVE-2026-59310 are tied to CISA KEV and explicit in-the-wild exploitation claims, and the closing states Cisco, vCenter, and WordPress are all being exploited in the wild. It also mentions patches/upgrades and technical vulnerability details, but no PoC or named exploit tool is provided.
~600,000 WordPress sites: The Events Calendar unauth RCE (CVE-2026-78006 / 78159). Crafted comment can lead to OS commands or admin password reset. Patch to 6.17.4.1+. MSP clients with event calendars: force update today. #WordPress #CVE #InfoSec Link: https://cybersecuritynews.com/critical-wordpress-plugin-flaws/
Post summary
The text discloses a critical unauthenticated RCE vulnerability affecting ~600,000 WordPress sites via The Events Calendar plugin (CVE-2026-78006 / 78159), describes the technical impact (OS command execution via crafted comments), and prominently directs users to patch to version 6.17.4.1+. No exploit tool, PoC, or active exploitation claim is mentioned.
The Events Calendar 6.17.4以下に、未認証でサーバー上のコードを実行される恐れがある脆弱性（CVE-2026-78006、CVSS 9.8） 情報源 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/the-events-calendar/the-events-calendar-6174-unauthenticated-php-object-injection-to-remote-code-execution
Post summary
CVE-2026-78006 is a remote code execution vulnerability in The Events Calendar 6.17.4 and below, rated CVSS 9.8, with no PoC, exploit code, or patch referenced.
@Dinosn 🚨 Critical WordPress Security Issue Two unauthenticated RCE vulnerabilities in The Events Calendar plugin (CVE-2026-78159 & CVE-2026-78006) could allow attackers to execute code and potentially take over sites. Update to the latest patched version ASAP.
Post summary
The message warns of two unauthenticated RCE vulnerabilities in The Events Calendar plugin and urges updating to the latest patched version.
🚨Google Pixelスマートフォンがゼロクリック攻撃の標的に（CVE-2026-58704） ⚠️認証不要のRCE脆弱性により、20万超のWordPressサイトが乗っ取りリスクにさらされる恐れ（CVE-2026-78159、CVE-2026-78006） 〜サイバーアラート9月17日〜 https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47781/
Post summary
The alert reports active zero-click exploitation targeting Google Pixel devices (CVE-2026-58704) and unauthenticated RCE vulnerabilities endangering over 200,000 WordPress sites (CVE-2026-78159, CVE-2026-78006).
Two unauthenticated RCE chains (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000+ sites. Both fire through pending-comment preview with zero login required, patched in version 6.17.4.1. - CVE-2026-78006 (CVSS 9.8): PHP Object Injection via is_safe_widget_instance() in Service_Provider.php. The guard calls unserialize() with allowed_classes => false, but PHP fires __unserialize() and __wakeup() magic methods during pre-parse before the return value is checked. A malformed tail token causes the guard to see false, declare the payload safe, and forge a valid wp_hash(). Core's real unserialize() then constructs Lazy_Post_Collection, whose custom_unserialize() passes attacker-controlled 'callback' and 'ids' directly to array_map(), enabling OS command execution as the web server user. - CVE-2026-78159 (CVSS 9.8): Arbitrary-callable RCE via Element_Classes::parse_array() in common/src/Tribe/Template.php. A plain array bypasses the object guard entirely. Attacker-controlled 'classes' keys reach parse_array(), which calls is_callable() without restricting to closures. Supplying wp_update_user with ID and user_pass entries resets the admin password to a known value; attacker logs in and uploads a malicious plugin. - Shared entry point: get_v1_single_event_html() buffers the full page including comments and passes it through do_blocks(). WordPress's KSES sanitizer preserves HTML comment delimiters, so Gutenberg block markup survives. #DFIR_Radar
Post summary
Two critical unauthenticated RCE vulnerabilities (CVSS 9.8) in The Events Calendar WordPress plugin affecting 600,000+ sites are disclosed with detailed technical analysis; both are patched in version 6.17.4.1.
WordPress プラグイン The Events Calendar の脆弱性 CVE-2026-78006／78159 が FIX：Web サイト乗っ取りの恐れ https://iototsecnews.jp/2026/09/15/critical-wordpress-plugin-flaws-put-over-600000-websites-at-risk-of-takeover/ WordPress の人気プラグインである The Events Calendar に関する脆弱性の紹介記事です。問題の背景として、ウィジェットの描画処理における検証の不備が存在し、未認証の第三者による不正操作が可能な状態となっていました。この問題により、Web サイトの乗っ取り／OS コマンドの実行／管理者パスワードのリセット／マルウェアの注入など、深刻な影響を受ける恐れがあります。対象となる脆弱性は CVE-2026-78006／CVE-2026-78159 です。対応策として、プラグインを安全なバージョン 6.17.4.1 以降へ迅速に更新すること／イベントページでのコメント機能の設定確認／不審なログの監視などが強く求められます。 #CVE202678006 #CVE202678159 #TheEventsCalendar #Vulnerability #WordPress
Post summary
The text highlights vulnerabilities in The Events Calendar plugin (CVE-2026-78006 and CVE-2026-78159) with technical details and strongly recommends patching to version 6.17.4.1 as a primary remediation step, classifying it as a Patch-focused disclosure.
@bitcoin180 @Dinosn CVE-2026-78159 / CVE-2026-78006 need event comments — a pending-comment preview is enough; no moderator approval. One chain is POI → OS commands; the other resets an admin password then drops a plugin. Jump to 6.17.3.1 / 6.17.4.1; disable event-page comments until patched.
Post summary
The tweet outlines technical details for two CVEs and advises upgrading to versions 6.17.3.1/6.17.4.1 and disabling comments as a temporary fix, making patch remediation the primary focus.
🚨 Critical WordPress Security Issue Two unauthenticated RCE vulnerabilities in The Events Calendar plugin (CVE-2026-78159 & CVE-2026-78006) could allow attackers to execute code and potentially take over sites. Update to the latest patched version ASAP.
Post summary
The tweet reports two unauthenticated RCE vulnerabilities in The Events Calendar plugin and urges users to update to the latest patched version, with no PoC or exploit details provided.
Si usas The Events Calendar (6.17.4 o menos), actualiza a 6.17.5. Sin login podían ejecutar código vía un comentario pendiente. Si no puedes hoy, apaga comentarios en eventos. https://www.wavys-technologies.com/es/blog/the-events-calendar-cve-2026-78006
Post summary
The text discloses CVE-2026-78006 in The Events Calendar (≤6.17.4), recommending users update to 6.17.5 or disable comments, as unauthenticated code execution via pending comments is possible. No PoC, exploit tools, or active exploitation reports are mentioned.
CVE-2026-78006: The Events Calendar (600k+ stron) ma lukę CVSS 9.8, atak bez logowania. Wersje do 6.17.4 podatne, łatka to 6.17.4.1. https://rjweb.pl/blog/the-events-calendar-luka-jak-sprawdzic-wersje-wtyczki/ https://t.co/WKGzva0unH
Post summary
The text announces a critical unauthenticated vulnerability (CVSS 9.8) in The Events Calendar plugin, highlighting that versions up to 6.17.4 are vulnerable and that the fix is to update to version 6.17.4.1.