Exploitation observed; activity peaked at 6 mentions and remains active
Immediate actions
Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
CVE-2026-78006 & CVE-2026-78159: Two unauthenticated vulnerability chains leading to RCE in The Events Calendar Plugin for WordPress, 9.8 Rating 🔥
Two critical vulnerabilities were recently disclosed in The Events Calendar Plugin for WordPress. The first uses PHP Object Injection to execute arbitrary OS commands on the underlying server. The second allows an unauthenticated attacker to reset an administrator’s password, after which the attacker can upload a malicious plugin and take complete control of the site. The first vulnerability (CVE-2026-78006) is already being exploited in the wild!
👉 https://nt.ls/mEm8O
Post summary
The Events Calendar Plugin for WordPress has two critical RCE chains (CVE-2026-78006 and CVE-2026-78159) rated 9.8, with CVE-2026-78006 confirmed as actively exploited in the wild via PHP Object Injection.
Two unauthenticated RCEs were just disclosed in "The Events Calendar", a WordPress plugin with more than 600,000 active installs.
They are tracked as CVE-2026-78159 and CVE-2026-78006, they are both scored 9.8 on the CVSS score and can both lead to a full site takeover. About 200,000 sites are estimated to be vulnerable.
I have seen this kind of bug before. During a client pentest, I found an unauthenticated SQL injection in FlipperCode’s Custom CSS, JS & PHP plugin. I was able to chain it all the way to remote code execution. That vulnerability became CVE-2026-6433. It was unauthenticated, meaning no admin or user credentials were needed and If the plugin was installed on a website, I could have a shell on the host.
This is the same pattern, just on a much bigger plugin. A lot of organisations treat the company website as a marketing page. It is also an internet-facing application, running plugins written by people you have never met. For a bank, a hospital, a fintech, or a capital-markets operator here, that site is part of the same attack surface as everything else you are trying to protect.
A scanner will not find a zero-day that is yet to be disclosed. However, an experienced pentester knows when to look under the hood and find a bug that others will ignore, just like a motivated attacker would.
If you run WordPress, check whether The Events Calendar is installed. If it is, please update it to 6.17.4.1 or later. Also, do not wait for the next advisory. Have your website tested the way an attacker would.
At @clarensecltd we include in-depth WordPress reviews in our assessments. You can send a message to info@clarensec.com or visit https://clarensec.com/contact
hashtag#WordPress hashtag#CyberSecurity hashtag#VAPT
Post summary
The post discloses two high-severity unauthenticated RCE vulnerabilities in The Events Calendar and provides a specific mitigation by instructing users to update to version 6.17.4.1 or later. Although it includes vulnerability details, the main actionable takeaway is the available patch.
🔴 WordPress The Events Calendar eklentisinde iki kritik RCE açığı: CVE-2026-78159 ve CVE-2026-78006 (CVSS 9.8)
Kimlik doğrulama gerektirmeden özel hazırlanmış bir payload ile kod enjeksiyonu ve uzaktan kod çalıştırmaya (RCE) yol açabiliyor.
CVE-2026-78159 — Unauthenticated Code Injection -> RCE
CVE-2026-78006 — Unauthenticated PHP Object Injection -> RCE
Etkilenen sürüm: 6.17.4.1 öncesi sürümler
Güncel sürüm: 6.17.4.1+
The Events Calendar kullanan WordPress siteleri mutlaka eklentiyi güncellemeli.
https://wordpress.org/plugins/the-events-calendar/
Post summary
Two critical RCE vulnerabilities (CVE-2026-78159 and CVE-2026-78006) have been disclosed for WordPress The Events Calendar (versions prior to 6.17.4.1); users are urged to update to the patched 6.17.4.1+ release.
【The Events Calendar - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation】
WordPress The Events Calendar プラグインに2つの重大なRCE脆弱性：CVE-2026-78159 および CVE-2026-78006 (CVSS 9.8)
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/the-events-calendar/the-events-calendar-6173-unauthenticated-code-injection-to-remote-code-execution-via-widget-classes-map-callable-invocation
Post summary
The text announces two critical remote code execution vulnerabilities (CVE-2026-78159 and CVE-2026-78006) in the WordPress The Events Calendar plugin, providing technical details and a CVSS score of 9.8, but does not mention exploits, patches, or active exploitation.
Threat actors are exploiting critical WordPress plugin vulnerabilities to upload PHP web shells and achieve unauthenticated remote code execution.
- WooCommerce Wholesale Lead Capture CVE-2026-27540 enables arbitrary file uploads through the wwlc_file_upload_handler AJAX action; more than 100,000 exploit attempts have been blocked since June 2026.
- Observed shell.php payloads report host details and provide a browser-based mechanism to upload additional files.
- Two The Events Calendar flaws, CVE-2026-78159 and CVE-2026-78006, enable remote code execution through pending-comment previews and can result in administrator password reset, malicious plugin upload, data theft, or full site takeover.
- Site owners should patch affected plugins and inspect uploads directories and suspicious admin-ajax.php requests.
VULNERABILITY
CVE-2026-27540
CVE-2026-78006
CVE-2026-78159
INDICATOR
104.194.9.138
114.10.43.203
187.75.114.36
23.137.105.214
23.180.120.140
31.59.129.150
37.114.144.209
92.241.13.140
92.241.13.213
ipv6:2a0f:85c1:840:5389::1
Get free accont on threatlandscape io
Post summary
Threat actors are actively exploiting multiple WordPress plugin CVEs (CVE‑2026‑27540, CVE‑2026‑78006, CVE‑2026‑78159) via arbitrary file uploads and remote code execution, with observed payloads and numerous attempted exploits; the article recommends patching affected plugins.
Two unauthenticated critical vulnerability chains in The Events Calendar WordPress plugin enable remote compromise of affected websites.
- CVE-2026-78006 uses PHP object injection, bypassed deserialization checks, and a gadget chain to execute operating-system commands.
- CVE-2026-78159 abuses arbitrary callable execution to invoke wp_update_user(), reset the administrator account password, and enable malicious plugin installation.
- Exploitation can be triggered through crafted Gutenberg markup in unapproved event-page comments and moderation-preview URLs, without comment approval.
- Administrators should update to version 6.17.4.1 or later, disable unnecessary event-page comments, review accounts and plugins, and investigate suspicious comment and preview activity.
VULNERABILITY
CVE-2026-78006
CVE-2026-78159
Post summary
The text discloses two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin (CVE-2026-78006 and CVE-2026-78159) with detailed technical descriptions, primarily serving to urge administrators to update to version 6.17.4.1 or later.
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 15, 2026
1️⃣ CISCO PATCHES CRITICAL ZERO-DAY IN SECURE EMAIL GATEWAY
Cisco fixed a zero-day in the AsyncOS platform that powers its Secure Email Gateway — CVE-2026-76461, rated CVSS 9.8 — where a single crafted email triggers a SQL injection that escalates straight to root-level remote code execution. No credentials, no user interaction, zero prerequisites: the message itself is the payload. CISA has added it to the Known Exploited Vulnerabilities catalog, so affected appliances should be patched and mail logs reviewed rather than assumed clean.
🔹 @ThreatAft
2️⃣ CISA: vCENTER RCE NOW IN RANSOMWARE GANGS' TOOLKIT
CISA updated its Known Exploited Vulnerabilities list to flag VMware vCenter CVE-2026-59310 — a critical, unauthenticated remote code execution via Syslog path traversal that had been patched back in July 2026. What changed is the abuse: ransomware crews are now actively exploiting it, after the flaw already saw APT reverse-SSH campaigns across dozens of countries. If you run vCenter, treat this as an emergency patch-and-exposure check, and keep the management interface off the public internet.
🔹 @Orion84x
3️⃣ COSTA RICA INVESTIGATES DARK WEB SALE OF TENS OF MILLIONS OF RECORDS
Costa Rica's National Cybersecurity Directorate is investigating a dark web post claiming to sell tens of millions of records tied to people in Costa Rica — including identity card photos, court files, vehicle registrations, and salary data. If the claim holds up, it would be one of the larger national-scale identity dumps in recent memory, and the mix of ID photos with court and income data makes it a serious fraud and identity-theft pipeline.
🔹 @NIKSUN
4️⃣ OPEN SOURCE GROWTHBOOK FLAW LEAKS DATA WAREHOUSE SQL
A newly disclosed high-severity flaw (CVE-2026-91198) in GrowthBook — the popular open source feature-flagging platform, versions 5.0.1 and below — lets an unauthenticated attacker reach the SQL sitting behind an organization's data warehouse. It is not direct database access, but it is close enough to expose the queries and structure behind your feature data. If GrowthBook is part of your stack, upgrade past 5.0.1.
🔹 @XQOPTRX
5️⃣ WORDPRESS EVENTS CALENDAR: TWO UNAUTH RCE CHAINS ON ~600K SITES
The Events Calendar WordPress plugin is hit with two unauthenticated remote code execution flaws — CVE-2026-78006 and CVE-2026-78159, both around CVSS 9.8. The attack path runs from a comment into a widget, yielding PHP object injection RCE, or an admin password reset without any login when event comments are enabled. With roughly 600,000 sites on the plugin, this is a fast route to mass scanning and mass compromise.
🔹 @Orion84x
6️⃣ VOICEBOX: LOCAL OPEN-SOURCE ALTERNATIVE TO ELEVENLABS
A new open source project called Voicebox — already past 53,000 GitHub stars under an MIT license — is being pitched as a local alternative to ElevenLabs and WisprFlow. You give it a short clip of your voice, it clones how you sound, and any AI agent connected to it can speak in that voice — all on your own hardware. For teams that want voice cloning without shipping recordings to a third-party cloud, it is a meaningful option.
🔹 @HelloVyom
7️⃣ NOFIRE OPEN-SOURCES BRIG: microVM SANDBOX FOR AI CODING AGENTS
NOFire has open-sourced Brig, a microVM sandbox (Apache 2.0) that runs AI coding agents in hardware-enforced isolation on Mac or Linux. The goal is containment by default: an auto-approved agent's package installs and credential use are locked inside a microVM instead of owning the whole machine. As agents get more autonomy, cheap isolation layers like this are becoming a real security primitive, not a nice-to-have.
🔹 @BadSignalAI
8️⃣ DELAWARE ENACTS AUTOMATED DECISION OPT-OUT RIGHT
Delaware has signed a data-privacy update that gives people an opt-out right for automated decision-making and broadens the overall reach of the state's privacy law. It is a small but directional signal: automated-decision opt-outs are moving from enterprise policy into statute, and more jurisdictions are likely to follow.
🔹 @kuriharan
💭 The common thread this morning is that patching alone is no longer the defense — exploitation is. Cisco, vCenter, and WordPress are all patchable, and all are being exploited in the wild anyway. Meanwhile the open source world is quietly shipping the counter-moves: a sandboxed runtime for autonomous agents, and local voice tools that keep your biometrics on your own hardware. The gap between exploit speed and patch speed is where security actually lives now, and tools like Brig are what help close it.
Which of these hits closest to home — do you run vCenter, or is GrowthBook part of your stack? Tell me your biggest patching headache below 👇
#CyberSecurity#OpenSource#Privacy#DataBreach#CVE
Post summary
The roundup reports multiple CVEs with concrete technical details and remediation advice, but the dominant theme is active exploitation, including CISA KEV listings, ransomware abuse, APT activity, and exploitation in the wild. No PoC or named exploit tool/code is provided.
🔒 #CyberSecurity
CVE-2026-78159: Unauthenticated RCE in The Events Calendar WordPress Plugin (CV…
"The NVD has published CVE-2026-78159, a CVSS 9.8 (CRITICAL) unauthenticated remote code…"
🔗 https://securityarsenal.com/blog/cve-2026-78159-unauthenticated-rce-in-the-events-calendar-wordpress-plugin-cvss-98-detection-and-remediation-guide
#CyberSecurity#ThreatIntel#cve202678159#critical#cve
Post summary
The text announces a new critical CVE (2026-78159) for the Events Calendar WordPress plugin, describing an unauthenticated RCE flaw with a CVSS score of 9.8; it does not provide a PoC, exploit code, active exploitation evidence, or patch details.
@Dinosn 🚨 Critical WordPress Security Issue
Two unauthenticated RCE vulnerabilities in The Events Calendar plugin (CVE-2026-78159 & CVE-2026-78006) could allow attackers to execute code and potentially take over sites.
Update to the latest patched version ASAP.
Post summary
Tweet announces two unauthenticated RCE vulnerabilities in The Events Calendar plugin and directs users to update to the latest patched version immediately.
The tweet alerts about vulnerabilities (CVE-2026-58704, CVE-2026-78159/78006) being actively exploited via zero-click attacks and RCE, targeting devices and WordPress sites, with no patches or PoCs mentioned.
Patched The Events Calendar yesterday? That closed 1 of 2 doors. Wordfence found a completely independent second bypass of the SAME safety check CVE-2026-78159. No login needed. Admin password reset + malicious plugin upload.
Both fixed in 6.17.4.1 verify you're actually on it. https://t.co/JUCNooQa8t
Post summary
The tweet reports that CVE‑2026‑78159 has been patched in version 6.17.4.1 and mentions a second bypass, but provides no PoC, exploit tool, or evidence of active exploitation.
Good morning. 🌅
Patched The Events Calendar yesterday? That only closed 1 of 2 doors. Wordfence found a SECOND, completely independent bypass of the same safety check CVE-2026-78159. No login needed. Admin password reset + malicious plugin upload.
Both fixed in 6.17.4.1. Verify you're actually on it.
Post summary
The post announces a second independent bypass of CVE-2026-78159 and notes both issues are fixed in version 6.17.4.1.
Two unauthenticated RCE chains (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000+ sites. Both fire through pending-comment preview with zero login required, patched in version 6.17.4.1.
- CVE-2026-78006 (CVSS 9.8): PHP Object Injection via is_safe_widget_instance() in Service_Provider.php. The guard calls unserialize() with allowed_classes => false, but PHP fires __unserialize() and __wakeup() magic methods during pre-parse before the return value is checked. A malformed tail token causes the guard to see false, declare the payload safe, and forge a valid wp_hash(). Core's real unserialize() then constructs Lazy_Post_Collection, whose custom_unserialize() passes attacker-controlled 'callback' and 'ids' directly to array_map(), enabling OS command execution as the web server user.
- CVE-2026-78159 (CVSS 9.8): Arbitrary-callable RCE via Element_Classes::parse_array() in common/src/Tribe/Template.php. A plain array bypasses the object guard entirely. Attacker-controlled 'classes' keys reach parse_array(), which calls is_callable() without restricting to closures. Supplying wp_update_user with ID and user_pass entries resets the admin password to a known value; attacker logs in and uploads a malicious plugin.
- Shared entry point: get_v1_single_event_html() buffers the full page including comments and passes it through do_blocks(). WordPress's KSES sanitizer preserves HTML comment delimiters, so Gutenberg block markup survives.
#DFIR_Radar
Post summary
The text discloses two critical unauthenticated RCE vulnerabilities (CVE-2026-78006 and CVE-2026-78159) in The Events Calendar WordPress plugin, provides deep technical root cause analysis for both chains, and explicitly states they are patched in version 6.17.4.1.
Japanese post announces fixed CVEs in The Events Calendar plugin, detailing widget validation flaws that could allow unauthenticated attackers to take over sites, and directs users to update to version 6.17.4.1+.
@bitcoin180@Dinosn CVE-2026-78159 / CVE-2026-78006 need event comments — a pending-comment preview is enough; no moderator approval. One chain is POI → OS commands; the other resets an admin password then drops a plugin. Jump to 6.17.3.1 / 6.17.4.1; disable event-page comments until patched.
Post summary
The tweet discloses technical details for two CVEs involving event comment handling leading to OS command execution and admin takeover, and primarily urges users to upgrade to versions 6.17.3.1/6.17.4.1 or disable event-page comments as a workaround.
🚨 Critical WordPress Security Issue
Two unauthenticated RCE vulnerabilities in The Events Calendar plugin (CVE-2026-78159 & CVE-2026-78006) could allow attackers to execute code and potentially take over sites.
Update to the latest patched version ASAP.
Post summary
The post discloses two critical unauthenticated RCE vulnerabilities in The Events Calendar WordPress plugin (CVE-2026-78159 and CVE-2026-78006) and urges immediate updating to the latest patched version.
The Events Calendar WordPress plugin: dual unauth RCE chains (~600k sites)
Why it matters: CVE-2026-78006 and CVE-2026-78159 (both ~9.8). Comment-to-widget path yields PHP object injection RCE or admin password reset without login when event comments are on.
Post summary
The text discloses two high-severity unauthenticated RCE vulnerabilities in The Events Calendar WordPress plugin and provides technical impact details, without mentioning PoC, active exploitation, or remediation.
