CVE-2026-78006

Name of the Vulnerable Software and Affected Versions The Events Calendar versions prior to 6.17.5

Description Unauthenticated attackers can achieve Remote Code Execution on the server due to insufficient protection in the is safe widget instance() function. The issue arises because PHP magic methods are triggered during pre-parse, and the enable rendering widget copied() function can forge a valid wp hash integrity attribute before the unserialize() function is reached. This allows for PHP Object Injection. The flaw is exploitable when comments are enabled and visible on events, as the V2 single-event template processes do blocks() over buffered comment HTML. An unauthenticated commenter can use a moderation-hash URL to view their pending comment immediately, delivering injected block markup to the vulnerable code path before moderation occurs.

Recommendations Update The Events Calendar to version 6.17.5 or later. As a temporary mitigation, disable comments on events to prevent the delivery of injected markup to the vulnerable code path.