Researchers at Wordfence’s Argus threat intelligence unit have disclosed two critical, unauthenticated vulnerabilities in The Events Calendar, a WordPress plugin built by StellarWP that powers event listings and ticketing on more than 600,000 live websites. Both flaws carry the maximum CVSS severity score of 9.8, meaning an attacker anywhere on the internet can potentially exploit them without ever needing a username, password, or any interaction from a site administrator.

Two Paths to the Same Outcome

The first flaw, tracked as CVE-2026-78006, is a PHP object injection vulnerability buried in the plugin’s widget-rendering code. It affects every version up to 6.17.4. Attackers can exploit it by submitting a malicious serialized payload disguised as a comment on an event page — including through pending comment preview links, which do not require a comment to be publicly approved first. When the plugin processes that comment, unsafe deserialization triggers PHP “magic methods” that were never meant to run on attacker-supplied data, giving the attacker a foothold to execute arbitrary code.

The second bug, CVE-2026-78159, affects versions up to 6.17.3 and stems from unsafe handling of callable functions inside the plugin’s widget template system. By supplying a carefully structured array, an attacker can sneak data past the plugin’s validation checks until it reaches a function that accepts a PHP callable — effectively letting the attacker choose what code runs, with arguments of their choosing.

Both vulnerabilities share a key precondition: the site must have comments enabled on its event pages, a default or common configuration for many event-driven WordPress sites, including venues, conference organizers, ticketing platforms, and community groups.

What a Successful Attack Looks Like

Because both bugs can lead to remote code execution, the potential blast radius is severe. Wordfence warns that successful exploitation could allow an attacker to reset administrator passwords, install malicious plugins or web shells, exfiltrate customer and ticketing data, deface the website, or use the compromised server as a foothold to pivot deeper into hosting infrastructure. Given the plugin’s popularity with organizations that process event registrations and payments, the exposure of personal and financial data is a particular concern.

Disclosure Timeline

Wordfence’s Argus system flagged the two flaws on August 21 and 22, 2026. StellarWP acknowledged the reports on August 24 and moved quickly to ship a fix, releasing version 6.17.4.1 shortly afterward that closes both holes. The relatively fast turnaround between disclosure and patch is a point in the vendor’s favor, but it does little good for the large share of the plugin’s installed base that has not yet applied the update — a common problem with WordPress plugins, where automatic updates are often disabled by site owners wary of breaking custom themes or integrations.

Recommended Actions for Site Owners

• Update The Events Calendar to version 6.17.4.1 or later immediately
• If an immediate update isn’t possible, disable comments on event pages as a temporary mitigation
• Review recent administrator account changes and password reset activity for signs of compromise
• Check server and access logs for unusual POST requests to event pages or widget endpoints
• Audit installed plugins for any unfamiliar additions, and remove plugins that are no longer actively used or maintained

The disclosure adds to a long-running pattern of critical flaws surfacing in widely deployed WordPress plugins, underscoring why security teams increasingly treat plugin update management as a frontline defense rather than routine housekeeping — a single unpatched extension can undo even a well-hardened WordPress core installation.

Why WordPress Plugins Remain a Favorite Target

WordPress now powers a substantial share of all websites on the internet, and its plugin ecosystem is what makes that scale possible — but it also creates an enormous, uneven attack surface. Core WordPress itself receives frequent, well-tested security updates, while third-party plugins vary widely in how quickly and thoroughly their maintainers respond to vulnerability reports. Attackers know this, and automated scanning tools make it trivial to fingerprint which plugin, and which version, a given site is running within seconds of a proof-of-concept becoming public.

That dynamic is exactly why researchers like those at Wordfence continue to prioritize auditing the plugins with the largest install bases: a single flaw in a tool used by 600,000 sites has a vastly larger blast radius than an equivalent bug in a niche extension used by a few hundred. For site owners, the practical takeaway is the same one security teams repeat after nearly every disclosure like this one — treat plugin updates with the same urgency as core WordPress security patches, and consider a web application firewall as a compensating control for the inevitable gap between disclosure and full patch adoption across the installed base.