{"id":11947,"date":"2026-09-17T13:42:13","date_gmt":"2026-09-17T19:42:13","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-102-critical-vulnerabilities-in-the-events-calendar-plugin-for-wordpress\/"},"modified":"2026-09-29T09:59:06","modified_gmt":"2026-09-29T15:59:06","slug":"alert-2026-102-critical-vulnerabilities-in-the-events-calendar-plugin-for-wordpress","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-102-critical-vulnerabilities-in-the-events-calendar-plugin-for-wordpress\/","title":{"rendered":"Alert 2026-102 Critical Vulnerabilities in The Events Calendar plugin for WordPress"},"content":{"rendered":"\n

Affected product(s):<\/h2>\n\n
Product<\/strong><\/td>CVE<\/strong><\/td>Affected versions<\/strong><\/td>Fixed version<\/strong><\/td><\/tr>
The Events Calendar for WordPress<\/strong><\/td>CVE\u20112026\u201178159<\/td>Up to 6.17.3, inclusive<\/td>6.17.3.1 or later<\/td><\/tr>
The Events Calendar for WordPress<\/strong><\/td>CVE\u20112026\u201178006<\/td>Up to 6.17.4, inclusive<\/td>6.17.4.1 or later<\/td><\/tr>
The Events Calendar for WordPress<\/strong><\/td>Both vulnerabilities<\/td>Versions prior to 6.17.4.1<\/td>6.17.4.1 or later<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

*Version 6.17.4.1<\/strong>, released on September 10, 2026, is the first release that contains fixes for both vulnerabilities.<\/p>\n\n

Description<\/h2>\n\n

Two critical remote code execution (RCE) vulnerabilities were identified in the The Events Calendar<\/strong> plugin for WordPress, developed by StellarWP. The flaws, CVE\u20112026\u201178006<\/strong> and CVE\u20112026\u201178159<\/strong>, have a CVSS 9.8<\/strong> score and allow remote unauthenticated attackers to take control of vulnerable sites under certain conditions, without requiring registration, login, or victim interaction.<\/p>\n\n

The plugin has more than 600,000 active installations<\/strong>. StellarWP published fixes for both vulnerability chains; it is recommended to update immediately to The Events Calendar 6.17.4.1 or a later version<\/strong> and perform a review for possible compromise, especially if the site allows comments on individual event pages.<\/p>\n\n

The vulnerabilities are located in the widget rendering process of The Events Calendar, particularly when the plugin processes content from an individual event page, including comments pending moderation. The attacker does not need the comment to be approved: WordPress allows whoever published a comment to view their own pending comment through a moderation link, which can cause attacker-controlled content to reach the vulnerable plugin logic.<\/p>\n\n

CVE<\/strong><\/td>CVSS<\/strong><\/td>Type<\/strong><\/td>Main condition<\/strong><\/td>Impact<\/strong><\/td><\/tr>
CVE\u20112026\u201178006<\/strong><\/td>9.8 \u2014 Critical<\/td>PHP Object Injection<\/td>Comments enabled on event pages and “Show comments on event pages” option active<\/td>Execution of system commands and RCE with permissions of the web server user<\/td><\/tr>
CVE\u20112026\u201178159<\/strong><\/td>9.8 \u2014 Critical<\/td>Code injection via callable invocation<\/em> \/ insufficient validation<\/td>Processing of controlled content within event widgets<\/td>Administrative password reset, admin access, and subsequent RCE<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Solution<\/h2>\n\n

The definitive solution is to update The Events Calendar<\/strong> to version 6.17.4.1 or later<\/strong>:<\/p>\n\n

\n
The Events Calendar<\/a><\/blockquote>