What Was Disclosed
Security researchers have disclosed two critical, unauthenticated remote code execution (RCE) vulnerabilities in The Events Calendar, a StellarWP-maintained WordPress plugin with more than 200,000 active installations. According to SecurityWeek's report, both flaws let an attacker take control of an affected site without ever authenticating — no valid credentials, no admin session, just a crafted request or comment sent to a public-facing page.
The two issues are tracked separately:
- The first flaw stems from insufficient validation in the plugin's widget template system. Researchers found that a specially crafted array-based payload can slip past an object-only safety check, with the resulting data later extracted into callable template variables. That path reportedly allows an attacker to invoke arbitrary WordPress functions with attacker-supplied arguments — including resetting the site administrator's password — opening the door to full admin takeover and, from there, a malicious plugin upload and code execution. This flaw affects versions through 6.17.3 and was fixed in 6.17.3.1, released August 25, 2026.
- The second is a PHP object injection (insecure deserialization) flaw that triggers when event-page comments are enabled. Researchers describe a bypass of a plugin-side safety check using a forged integrity value, allowing PHP "magic methods" to fire during deserialization before validation ever completes — notably, an attacker reportedly doesn't even need an approved comment, since WordPress lets commenters preview their own pending submissions. The resulting chain can route attacker-supplied values into a callable function capable of executing operating-system commands. This flaw affects versions through 6.17.4 and was fixed in 6.17.4.1, released September 10, 2026.
Both issues were reported to StellarWP through Wordfence's vulnerability disclosure channel; the vendor acknowledged the reports on August 24, 2026, and shipped fixes for each shortly after. Some reporting indicates exploitation attempts targeting the object-injection flaw have already been observed in the wild, which underscores the urgency of patching rather than waiting on a routine update cycle.
Why This Matters at 200,000+ Sites
An unauthenticated RCE in a plugin this widely deployed is about as severe as WordPress vulnerabilities get. There's no login wall, no phishing step, and no social engineering required — an attacker only needs to locate a reachable site running a vulnerable version. The Events Calendar is popular with small businesses, nonprofits, schools, churches, and community organizations publishing public event listings, many of which lack a dedicated security team tracking plugin disclosures. Because both bugs can lead to full administrative control and arbitrary code execution, a successful exploit hands an attacker everything: the ability to plant backdoors, exfiltrate data, pivot to other tenants on shared hosting, or conscript the server into a botnet.
The staggered patch timeline is also worth flagging. The two fixes landed a full two weeks apart — 6.17.3.1 in late August, then 6.17.4.1 in September — so a site that updated once and stopped at 6.17.4 would still be exposed to the second flaw. Version strings that get truncated to major.minor in an asset inventory won't catch that gap; the trailing point-release digit is what separates vulnerable from patched here.
What Site Owners Should Do
- Update immediately. Confirm The Events Calendar is running 6.17.4.1 or later — check the full version string, not just the minor version, given how close together the two patches shipped.
- Disable comments on event pages as an interim mitigation if you cannot patch right away; the object-injection path specifically requires comments to be enabled and visible.
- Audit for signs of compromise: unexpected administrator accounts, unfamiliar plugin or theme files, modified core files, and new or unrecognized scheduled tasks.
- Review logs around and after the August 24 disclosure date for unusual requests to comment-handling or widget-rendering endpoints.
- Deploy WAF rules where available as a stopgap for sites that can't patch instantly — many WAF vendors ship virtual patches for disclosures like this ahead of a site owner's own update cycle.
Second Major Disclosure This Year
This is the plugin's second major security disclosure in 2026. Back in June, CosmicBytez Labs covered CVE-2026-49772, a critical blind SQL injection affecting Events Calendar versions 6.15.12 through 6.16.2. That flaw and this month's unauthenticated RCE pair are unrelated in root cause, but together they're a reminder that a plugin's popularity is itself part of the risk calculus — the larger the install base, the more attractive it becomes for both security researchers and attackers to dig into. Site owners running The Events Calendar should treat plugin updates as a standing priority, not a periodic chore.