CVE-2026-78006 is a critical remote code execution vulnerability in the The Events Calendar WordPress plugin (versions <=6.17.4). It stems from insufficient validation in the is_safe_widget_instance function, which can be bypassed due to PHP firing magic methods during pre-parsing and the enable_rendering_widget_copied() function forging a valid wp_hash integrity attribute before unserialize() is called. This allows unauthenticated attackers to execute arbitrary code on the server. The vulnerability is exploitable without authentication because the plugin's V2 single-event template processes buffered comment HTML via do_blocks(), and WordPress returns a moderation-hash URL that lets unauthenticated commenters view their own pending comments immediately, delivering malicious block markup to the vulnerable code path before moderation.

Successful exploitation results in remote code execution on the server hosting the vulnerable plugin, with no authentication required. This can lead to full compromise of the affected WordPress site, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 9.8 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling comments on events or restricting comment functionality to trusted users to mitigate exploitation risk.