Reported by 7 outlets

Timeline

1. original reporting

   Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

   securityweek.com · 27d ago · September 16th, 2026

   More than 200,000 WordPress websites are potentially exposed to takeover attacks via two critical-severity vulnerabilities in The Events Calendar plugin. A highly popular plugin with over 600,000 active installations, The Events Calendar allows administrators to easily create and manage an events calendar on their websites. All plugin versions before 6.17.3.1 are affected by two code injection bugs that could lead to remote code execution (RCE), allowing attackers to take over sites, WordPress security firm Defiant explains . The first security defect, tracked as CVE-2026-78159 (CVSS score of 9.8), is described as an unauthenticated code injection caused by insufficient validation. Under certain conditions, an attacker can inject a plain-array payload that bypasses checks and executes during the processing of single-event HTML, including the comment area. StellarWP, The Events Calendar’s developer, patched the flaw on August 25 in version 6.17.3.1 of the plugin. Tracked as CVE-2026-78006 (CVSS score of 9.8), the second vulnerability is described as an unauthenticated PHP object injection issue that can be exploited if comments on events are enabled and visible. The security defect exists because insufficient protections in a plugin function can be bypassed by a commenter without authentication or approval, because the injected code is delivered to the vulnerable function before moderation occurs. StellarWP resolved the second flaw in

2. mentioned by www.thehackerwire.com

   🔴 CVE-2026-78006 - Critical (9.8) The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to,

   www.thehackerwire.com · 31d ago · September 12th, 2026

3. update from radar.offseq.com

   CVE-2026-78159: CRITICAL RCE in The Events Calendar ( https:// radar.offseq.com/threat/cve-20 26-78159-cwe-94-improper-control-of-generation

   radar.offseq.com · 31d ago · September 12th, 2026

   CVE-2026-78159: CRITICAL RCE in The Events Calendar ( https:// radar.offseq.com/threat/cve-20 26-78159-cwe-94-improper-control-of-generation

   via Mastodon https://radar.offseq.com/threat/cve-2026-78159-cwe-94-improper-control-of-generation-of-code-code-injection-in-stellarwp-the-events-c0d168b99a9315ff

4. update from securityonline.info

   A critical The Events Calendar vulnerability is exploited in the wild. Patch The Events Calendar vulnerability now to stop remote code execu

   securityonline.info · 29d ago · September 15th, 2026

   Patch The Events Calendar vulnerability now to stop remote code execu

   via Mastodon https://securityonline.info/the-events-calendar-vulnerability-exploited/?utm_source=mastodon&utm_medium=jetpack_social

5. update from cyberpress.org

   Critical WordPress Plugin Bugs Let Attackers Reset Admin Passwords and Take Over Sites

   cyberpress.org · 28d ago · September 15th, 2026

   Two critical, unauthenticated vulnerability chains in The Events Calendar WordPress plugin could let remote attackers reset administrator passwords, execute operating-system commands, and take over vulnerable websites. StellarWP, the plugin’s developer, has released fixes, and administrators are urged to update to version 6.17.4.1 immediately. Attackers can abuse unsafe deserialization behavior to trigger a gadget chain within the plugin and execute arbitrary commands on the underlying web server. It stems from inadequate validation of a widget classes map and can enable arbitrary PHP callable invocation. Rather than directly executing a system command, attackers can invoke WordPress functions with attacker-controlled arguments. Researchers demonstrated that this route could be used to invoke the wp_update_user() function and reset the password for administrator account ID 1. Once logged in as an administrator, an attacker could upload a malicious plugin, establish persistent access, st

6. update from gbhackers.com

   WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

   gbhackers.com · 28d ago · September 15th, 2026

   These flaws, identified by Wordfence Argus, impact plugin versions up to 6.17.4 and have been patched in version 6.17.4.1. The Events Calendar is active on over 600,000 WordPress websites, […] The post WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

7. update from securebulletin.com

   Two Critical Flaws in a Popular WordPress Calendar Plugin Put 600,000+ Sites at Risk of Full Takeover # CyberSecurity https:// securebulleti

   securebulletin.com · 27d ago · September 16th, 2026

   Two Critical Flaws in a Popular WordPress Calendar Plugin Put 600,000+ Sites at Risk of Full Takeover # CyberSecurity https:// securebulleti

   via Mastodon https://securebulletin.com/two-critical-flaws-in-a-popular-wordpress-calendar-plugin-put-600000-sites-at-risk-of-full-takeover/