This vulnerability (CVE-2026-78265) affects Nexcess The Events Calendar plugin versions <= 6.17.2 and is caused by unsafe deserialization of untrusted data leading to unauthenticated PHP Object Injection. The flaw allows an attacker to inject malicious PHP objects without authentication, potentially resulting in full compromise of the affected system. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow remote attackers to execute arbitrary PHP code on the server running the vulnerable plugin without authentication, leading to complete system compromise including data theft, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or removing the affected plugin version to mitigate risk.