PHP object injection affecting WordPress The Event Calendars plugin
A critical vulnerability affecting The Events Calendar extension would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
The Events Calendar is a popular WordPress plugin designed for creating and managing events. This plugin is affected by a vulnerability labeled CVE-2026-78265 resulting from unauthenticated PHP object injection. Exploitation of this vulnerability would allow an unauthenticated malicious actor to manipulate serialized data to remotely execute arbitrary code or cause other unauthorized actions on the system. It is classified critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Data privacy breach;
- Data integrity breach;
- Breach of data availability;
- Remote Arbitrary Code Execution;
Affected systems
Products, components and targeted versions
- Versions of The Event Calendars plugin prior to 6.17.3;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update The Events Calendars to version 6.17.3 or later;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.