Two Vulnerability Chains in The Events Calendar Let an Anonymous Comment Trigger Full Site Takeover

Wordfence has disclosed two independent vulnerability chains in The Events Calendar, a WordPress calendar plugin running on more than 600,000 sites, that together let an anonymous website visitor take full control of a server by submitting nothing more than a blog comment. Both chains carry the maximum practical CVSS severity of 9.8, and both were found not by a lone human researcher but by Wordfence Argus, the company’s AI-assisted vulnerability discovery tool, working with Wordfence Threat Intelligence analyst Chloe Chamberland. The Events Calendar’s developer, StellarWP, now folded into Liquid Web’s Nexcess brand, has shipped a complete fix in version 6.17.4.1, and any site still running an older release should update immediately.

A Comment No Moderator Ever Approved

Both vulnerability chains start in the same place: the way The Events Calendar’s newer V2 template renders comments left on an event page. When a visitor loads a single event, the plugin runs WordPress’s do_blocks() function over the buffered HTML of that page’s comment section, which means any Gutenberg block markup hidden inside a comment gets executed as if it were a real block, not just displayed as plain text.

Normally that would still require getting a comment approved by a moderator first, since a stranger’s first comment on most sites is held for review by default. Wordfence found a way around that step entirely: WordPress itself gives an anonymous commenter a special moderation-hash link so they can preview their own pending comment before anyone approves it. Loading that link triggers the same do_blocks() rendering pass on the still-unapproved comment, delivering the malicious block payload straight into the vulnerable code path before a human moderator ever sees it. According to Wordfence, no login, account registration, or social engineering is required, though the target event page must have comments enabled, specifically The Events Calendar’s own “Show comments on event pages” setting.

Two Different Ways In

The first chain, tracked as CVE-2026-78006, abuses a function called is_safe_widget_instance() that is supposed to check whether stored widget data is trustworthy before the plugin unserializes it. Wordfence found that PHP fires certain “magic methods” during the earliest stage of parsing a comment, before that integrity check even runs, and that a companion function, enable_rendering_widget_copied(), can be tricked into forging a valid integrity hash on attacker-controlled data. Once the check is fooled, the plugin calls PHP’s unserialize() on a value the attacker fully controls, a textbook PHP Object Injection bug (CWE-502) that Wordfence says can be chained into arbitrary operating-system command execution on the server.

The second chain, CVE-2026-78159, takes a different route to the same class of outcome. Instead of forging the integrity check, it exploits how the plugin’s Element_Classes::parse_array() function reads a widget’s “classes” map: submitting a plain array instead of the expected object sidesteps the is_safe_widget_instance() guard entirely and lands in a callable-invocation sink, a Code Injection flaw (CWE-94) that Wordfence says an attacker can use to reset an administrator’s password and then upload a malicious plugin, netting complete control of the site.

A Fast Patch From a Newly Renamed Vendor

Wordfence sent full disclosure details for the first chain to StellarWP through its Vulnerability Management Portal on August 21. StellarWP acknowledged the report on August 24 and shipped an initial patch the next day, just four days after disclosure. The second chain followed a similar path: disclosed August 23 once Wordfence had validated the report and confirmed a working proof-of-concept exploit, acknowledged the same day as the first, and finished off with what Wordfence calls a fully patched version on September 10. WordPress.org’s own changelog lists that release as version 6.17.4.1, describing the fix only as “strengthened validation of copied widget instances.”

Wordfence Premium, Care, and Response customers received a firewall rule blocking known exploit attempts against both chains on August 22, the day after the first disclosure. Sites running the free version of Wordfence will not get that same protection until September 21, the 30 day delay the company builds into free tier rule releases. That leaves a month long window in which unpatched, free-Wordfence sites remain exposed to a now publicly documented attack chain unless an administrator updates the plugin directly rather than waiting on the firewall.

This is the second time in recent weeks that sxz.io has covered a maximum-severity object injection chain in a plugin from StellarWP’s product family, now folded into Nexcess: a similar CVSS 10.0 flaw in GiveWP, the donation plugin StellarWP also owned, let anonymous visitors take over donation sites 17 days earlier through nearly the same unserialize-then-execute pattern. Site owners running any Nexcess-owned plugin, including The Events Calendar, GiveWP, LearnDash, or Kadence, have reason to treat “update immediately” as the default response to a security notice from that product family rather than waiting to confirm real-world exploitation first.