CVE-2026-78265: CWE-502 Deserialization of Untrusted Data in Nexcess The Events Calendar

This vulnerability is an unauthenticated PHP object injection in The Events Calendar plugin for WordPress versions <= 6.17.2. It arises from unsafe deserialization of untrusted data (CWE-502), enabling remote attackers to inject malicious PHP objects. The CVSS 3.1 score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported as of the publication date.

Successful exploitation could lead to remote code execution with full system compromise, allowing attackers to control the affected system, steal data, modify content, or disrupt service. The vulnerability requires no authentication and can be triggered remotely over the network, making it highly dangerous.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and consider disabling it if possible. Monitor vendor channels for updates and apply patches promptly once available.