A calendar plugin is the kind of everyday website feature that can be easy to overlook in a security discussion. Yet the code behind it can reach far beyond displaying dates and events. When that code handles public input without enforcing the right boundaries, even a comment awaiting moderation can become a route to privileged access.
The recent WordPress Events Calendar RCE vulnerabilities both allow arbitrary commands through specially crafted payloads. This allows attackers to access elevated privileges, either directly against the filesystem or through WP admin commands. This is, to put it technically, “bad”.
Understanding how those attacks worked helps explain why the implications extend beyond this particular plugin.
Two bugs, one shared surface
There were two issues. CVE-2026-78159 was patched in version 6.17.3.1 on August 26. In this case, is_callable() trusted any global function name instead of restricting to safe ones. The attacker-controlled classes map walks straight into powerful functions like wp_update_user() to trigger an admin password reset. Resetting account credentials, especially of admin users, should require proper authentication and authorization to prevent this kind of account takeover.
CVE-2026-78006 was patched separately in 6.17.4.1 on September 10. The attacker posts a “comment” that’s actually crafted WordPress block markup hiding a malicious serialized PHP payload. WordPress gives the commenter a moderation-hash link to preview their own pending comment, a normal, unauthenticated feature. When the attacker visits that link, loading the page runs do_blocks() over the comment content. The plugin’s safety check runs too late. PHP fires magic methods during unserialize before the check ever runs, and the “integrity” hash can be forged for attacker data. With the right classes available on the site, that escalates to arbitrary code execution: webshell, injected admin account, full server compromise.
Beneath those technical details is a basic question: who should be able to make the software perform these actions? Authentication is who someone is and authorization is what they can do. In this case, both were bypassed because of the way the underlying calendar software parsed user provided content.
A pattern, not a one-off
The specifics of how the exploits happened are one-off mistakes. The delivery mechanism is not plugin-specific at all. WordPress lets unauthenticated commenters preview their own pending comment, and some plugin runs rich content processing over that unmoderated content before a human ever approves it. That combination – public input gets rendered through powerful processing before moderation – shows up constantly in the WordPress plugin ecosystem.
The distinction matters because fixing an individual bug does not, by itself, resolve the broader question of how untrusted content reaches privileged processing.
Scale and urgency
About 40% of the 600,000+ active installations have not upgraded, with roughly 240,000 sites still on pre-6.17 versions. While some may be using workarounds or have disabled comments, a significant number of them will be at risk.
Both flaws are accessible to unauthenticated attackers, and both allow arbitrary code execution, up to and including admin account or shell access. Many sites have not upgraded even after days of a high priority vulnerability being published. This is still an urgent issue. Public proof-of-concept code exists, meaning this has likely already been scanned for and exploited against exposed sites.
The patching timeline adds another practical consideration for administrators assessing their exposure.
The two-week gap between fixes isn’t negligence, it’s a design constraint showing through. They patched each exploitation technique as they found it instead of closing the shared comment-preview delivery path once. And if you stopped at plugin version 6.17.3.1 thinking you were done, you weren’t.
What to do this week
For site owners, that means checking both the update they installed and any signs of what may have happened before it.
- Confirm the actual version; don’t be content with “I updated the plugins.” The fix is 6.17.4.1, a fourth-level point release easy for scanners and even humans to miss.
- If you can’t patch immediately, kill the delivery path. Turn off “Show comments on event pages” (or disable comments on the tribe_events post type entirely). That single setting removes the unauthenticated route for both CVEs.
- Check, don’t assume your site is clean. Look for unexpected admin accounts, unfamiliar files in wp-content/uploads or plugin directories, and unusual outbound connections. Other detection strategies are outlined in the CVEs.
For developers, the same incident points to decisions that need to happen before a release reaches those site owners. Developers should never let unmoderated content touch the trusted rendering pipeline: preview does not equal approved. Validate before the dangerous call, in the same path, not next to it. Use an allowlist and gate every privileged action at the point of execution.
Few people realize how many layers of abstraction software has. Even something as trivial as a calendar on a website is built on many components and function calls. These components have wedge and integration points that can be used by attackers, especially those that take user controlled inputs like comments.
_______
About Dan Moore
Dan Moore is the senior director of CIAM strategy and identity standards at FusionAuth, where he drives B2C product direction and serves as a primary spokesperson on authentication, developer identity, and the emerging challenge of securing AI agents. With over 25 years of software engineering experience — including stints as a CTO, AWS certification instructor, and engineering manager — he is a regular speaker at identity and security conferences and a sought-after podcast guest on authentication and developer security. He is the author of Letters to a New Developer (Apress) and a contributor to 97 Things Every Cloud Engineer Should Know (O’Reilly).
Join our LinkedIn group Information Security Community!
