The Events Calendar WordPress Plugin Unauthenticated PHP Object Injection to RCE

Technical Analysis

The vulnerability (CVE-2026-78006, CVSS 9.8) resides in the is_safe_widget_instance function, where PHP's tendency to fire magic methods during pre-parse allows an attacker to bypass integrity validation before unserialize() is invoked. The enable_rendering_widget_copied() function can be abused to forge a valid wp_hash integrity attribute, defeating the plugin's intended protection against untrusted deserialization. The exploit chain leverages WordPress's moderation-hash URL feature, which lets unauthenticated commenters view their own pending comments, delivering malicious block markup directly into the do_blocks() rendering path on the V2 single-event template before moderation review occurs. Because this plugin is commonly bundled into WordPress-based CMS and web-frontend deployments, any organization exposing WordPress instances that also host internal tools, API gateways, or lightweight RAG/agent-facing web frontends on the same server is at risk of full server compromise, credential exfiltration, and lateral movement into adjacent agent infrastructure if secrets or API keys are stored on the same host.

Affected Systems

The Events Calendar WordPress plugin, all versions up to and including 6.17.4; requires WordPress installations with comments enabled and visible on event posts using the V2 single-event template

Indicators of Compromise

• No specific IOCs published at time of disclosure (vulnerability disclosure without confirmed in-the-wild exploitation samples); monitor for anomalous POST requests to comment endpoints containing serialized PHP object payloads targeting wp-json or wp-comments-post.php

Remediation Steps

1. 1

   Patch Immediately

   Update The Events Calendar plugin to the latest patched version beyond 6.17.4 as soon as it is released by the vendor.

2. 2

   Disable Comments on Events

   As an interim mitigation, disable comments on event pages to break the exploitation chain that relies on the moderation-hash preview URL.

3. 3

   Web Application Firewall Rules

   Deploy WAF rules to detect and block serialized PHP object payloads and suspicious block markup injected via comment fields.

4. 4

   Isolate WordPress Hosts

   Ensure WordPress servers are isolated from systems storing sensitive API keys or agent credentials to limit blast radius if compromised.

5. 5

   Monitor for Exploitation

   Review server and application logs for unexpected PHP object instantiation, unusual outbound connections, or webshell creation following comment submissions.