Loading story…
Benin’s bjCSIRT issued a warning about remote code execution affecting the WordPress plugin The Events Calendar. A related Patchstack vulnerability entry identifies PHP object injection associated with plugin version 6.17.4. PHP object injection can potentially enable code execution when exploitable object-handling paths and suitable application components are present; the available information does not establish those prerequisites or confirm active exploitation.
Organizations using The Events Calendar should prioritize identifying installed versions, checking the affected-version range and remediation guidance in the Patchstack entry and vendor advisories, and applying a confirmed security update. If no fix is available, assess temporarily disabling the plugin, particularly on business-critical or internet-facing WordPress sites. Do not assume version 6.17.4 is a fixed release merely because it appears in the vulnerability listing.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
bjCSIRT published an advisory about a remote code execution vulnerability affecting The Events Calendar plugin for WordPress. The supplied reference does not provide technical details or remediation information.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A PHP object-injection vulnerability affects **The Events Calendar** WordPress plugin, including version `6.17.2`. The flaw could allow unsafe deserialization of attacker-controlled data, potentially enabling malicious object manipulation in vulnerable WordPress installations. Site administrators should identify deployments of The Events Calendar and update to the vendor-fixed release as soon as available. Until patched, restrict untrusted input paths, review plugin activity and application logs for suspicious serialized payloads, and remove or disable the plugin where it is not required.
Aug 27, 2026
Two critical unauthenticated vulnerabilities in StellarWP's **The Events Calendar** WordPress plugin—`CVE-2026-78006` and `CVE-2026-78159`, both rated CVSS 9.8—can enable takeover of more than 600,000 active sites. The flaws abuse attacker-controlled comment content processed as Gutenberg blocks and the plugin's generation of integrity hashes for legacy-widget instances. `CVE-2026-78006` permits PHP object injection and arbitrary operating-system command execution, while `CVE-2026-78159` can invoke arbitrary PHP callables; researchers demonstrated an administrator-password reset that can lead to site compromise and remote code execution. Exploitation requires comments to be enabled and displayed on event posts, but requires no account, registration, or moderator approval: attackers can abuse the pending-comment moderation-preview flow. StellarWP addressed `CVE-2026-78159` in version 6.17.3.1 and both vulnerabilities in **6.17.4.1**. Administrators should update immediately, review event-post comment configurations, investigate administrator accounts for unauthorized changes, and examine logs for suspicious comment or moderation-preview activity.
Sep 17, 2026
Two high-severity vulnerabilities have been disclosed in popular WordPress snippet-management plugins, exposing sites to **remote code execution** through `CWE-94` code injection flaws. `CVE-2026-25001` affects **Post Snippets** by Saad Iqbal in versions through `4.0.12`, while `CVE-2026-25366` affects **Woody ad snippets** (`insert-php`) by Themeisle in versions through `2.7.1`. Both issues were documented with Patchstack references and indicate that attackers could inject or include malicious code on vulnerable WordPress installations. The two CVEs differ in attack complexity but both carry severe impact to confidentiality, integrity, and availability. `CVE-2026-25001` is scored with `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`, while `CVE-2026-25366` carries `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, making the Woody ad snippets flaw easier to exploit once low privileges are obtained. Organizations running either plugin should identify affected versions, prioritize updates beyond the vulnerable releases, and review WordPress environments for signs of unauthorized code execution.
Jun 29, 2026