Loading vulnerability…
CVE-2026-78006 is a critical unauthenticated PHP object-injection vulnerability in StellarWP The Events Calendar for WordPress through version 6.17.4. Insufficient validation in is_safe_widget_instance can be bypassed through PHP magic-method execution during deserialization pre-parsing. The enable_rendering_widget_copied function generates a valid WordPress integrity hash for attacker-controlled legacy-widget data, allowing it to pass the subsequent integrity check and reach unserialize(). The V2 single-event template processes buffered comment HTML with do_blocks(), permitting crafted Gutenberg legacy-widget markup in an event comment to reach this deserialization path. Pending-comment preview functionality enables an unauthenticated commenter to trigger rendering before moderation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This two-file repository consists of a Python 3 async exploitation utility (CVE-2026-78006.py) and a detailed Markdown description (README.md). It is not a framework module or a detection-only script. The Python tool accepts a site-list path and concurrency value interactively, then uses aiohttp/asyncio for concurrent target processing and Rich for status display. Command-line options control the post-exploitation command and optional WordPress administrator credentials. The exploit builds PHP-serialized Tribe__Utils__Callback and Tribe\\Utils\\Element_Classes objects, Base64-encodes them into a WordPress legacy-widget block, and relies on vulnerable widget instance deserialization during event-comment rendering. Its documented unauthenticated delivery chain is: submit a crafted event comment, obtain/access the pending comment's moderation-hash URL, trigger V2 event-template block processing, and reach PHP object deserialization. The callback chain attempts Windows and Unix working-directory discovery, document-root/environment discovery, whoami, phpinfo, webshell creation, and optional wp_insert_user administrator creation. The embedded webshell executes the c GET parameter through PHP system(). Candidate shell paths are wp-content/uploads/, wp-content/, and the current working directory. The tool records successful shells and created administrator credentials locally. There is a version discrepancy: the script header identifies targets as The Events Calendar <= 6.17.2, while README documentation states that the advisory range is <= 6.17.4; the exact fixed version should be independently verified.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated PHP object-injection-to-RCE vulnerability in The Events Calendar WordPress plugin. Malicious Gutenberg block markup submitted in an event comment can bypass widget-instance validation and WordPress integrity validation. A Lazy_Post_Collection deserialization gadget ultimately passes attacker-controlled callback and arguments to array_map(), permitting operating-system command execution as the web-server user.
An unauthenticated remote code execution vulnerability in The Events Calendar WordPress plugin through version 6.17.4. The flaw involves bypassing protections in is_safe_widget_instance through PHP magic-method behavior and a forged wp_hash integrity attribute prior to unserialize(). Exploitation requires event comments to be enabled and visible, and abuses the V2 single-event template processing buffered comment HTML with do_blocks().
Critical unauthenticated PHP object-injection/deserialization remote-code-execution vulnerability in The Events Calendar WordPress plugin through version 6.17.4. Attackers can exploit the vulnerable widget handling and comment-rendering path to execute server-side code when event comments are enabled and visible.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.