CVE-2026-78159

Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.4

Description Unauthenticated attackers can achieve Remote Code Execution on the server through the parse array() function in Element Classes::parse array(). The issue stems from insufficient validation of the widget classes map, which allows a plain-array payload to bypass the is safe widget instance() object check and reach a callable-invocation sink. This attack chain is triggered when do blocks() processes the single-event HTML including the comment area. Successful exploitation requires that the site has comments enabled on tribe events posts and that a comment containing a crafted wp:legacy-widget block has been submitted.

Recommendations Update The Events Calendar to version 6.17.4 or later. As a temporary mitigation, disable comments on tribe events posts to prevent the attack chain from being triggered.