The Events Calendar WordPress Plugin Unauthenticated RCE via parse_array Widget Bypass

Technical Analysis

CVE-2026-78159 stems from insufficient input validation in the parse_array function within Element_Classes::parse_array(), where a plain-array payload can bypass the is_safe_widget_instance() object type check. This allows attackers to smuggle a malicious callable into the widget 'classes' map, which is then invoked when do_blocks() renders comment content on single-event pages. The attack chain requires comments to be enabled on tribe_events post types and at least one attacker-submitted comment containing a crafted wp:legacy-widget block, making it a stored, trigger-on-render exploitation pattern rather than a direct request-based RCE. Successful exploitation grants unauthenticated attackers full code execution on the underlying server, potentially leading to complete site compromise, data exfiltration, or use as a pivot point into hosting infrastructure. This is a WordPress/CMS-specific vulnerability with no direct AI agent runtime or RAG pipeline impact; however, if agent systems ingest content from compromised WordPress sites (e.g., via web scraping, browsing tools, or RAG data sources), the compromised site could be leveraged to serve malicious payloads or manipulated content back to agents processing that site's output, and any API keys or credentials stored in the WordPress environment (e.g., wp-config.php secrets used for integrations) could be exposed to attacker-controlled code execution.

Affected Systems

The Events Calendar WordPress plugin, all versions up to and including 6.17.3; requires WordPress sites with tribe_events post type comments enabled

Indicators of Compromise

• No specific IOCs published at this time; monitor for anomalous comments containing wp:legacy-widget block syntax with unusual 'classes' array structures on tribe_events posts

Remediation Steps

1. 1

   Update Plugin Immediately

   Upgrade The Events Calendar plugin to the patched version beyond 6.17.3 as soon as it is released by the vendor.

2. 2

   Disable Comments on Events

   As a temporary mitigation, disable comments on tribe_events post types to break the exploitation chain.

3. 3

   Audit Existing Comments

   Review and purge any existing comments on event pages for suspicious wp:legacy-widget block content or malformed array payloads.

4. 4

   Web Application Firewall Rules

   Deploy WAF rules to detect and block comment submissions containing wp:legacy-widget block patterns with anomalous array structures.

5. 5

   Monitor Server Logs

   Review server and application logs for signs of unexpected code execution, unfamiliar file writes, or unusual process spawning correlated with comment submission events.

6. 6

   Least Privilege Hosting

   Ensure the web server process runs with minimal privileges and file system access to limit blast radius if exploitation occurs.