Multiple vulnerabilities affecting WordPress The Events Calendar plugin

The Events Calendar is a popular WordPress plugin designed for creating and managing events. This product is affected by several vulnerabilities labeled as follows: CVE-2026-78006: This vulnerability arises from insufficient protection in the is_safe_widget_instance function, which can be bypassed because PHP triggers magic methods during its preparse, combined with enable_rendering_widget_copied() which forges a valid wp_hash integrity attribute before unserialize() is reached. Exploitation of this vulnerability would allow an unauthenticated malicious actor to remotely execute code on the server. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1. CVE-2026-78159: This vulnerability is caused by insufficient validation of the widget 'classes' map, allowing a simple array payload to bypass the is_safe_widget_instance() object check and reach the function invocation vulnerability in Element_Classes::parse_array(). Exploitation of this vulnerability would allow an unauthenticated malicious actor to remotely execute code on the server. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1.

• Versions of The Events Calendar plugin prior to or equal to 6.17.4;