The Events Calendar plugin for WordPress is vulnerable to remote code execution in all versions up to and including 6.17.4 due to insufficient protection in the is_safe_widget_instance function. Attackers can bypass security checks because PHP executes magic methods during pre-parsing, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This allows unauthenticated attackers to execute arbitrary code on the server. The vulnerability is exploitable without authentication because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that lets unauthenticated commenters immediately view their own pending comments, delivering the injected block markup to the vulnerable code path before moderation.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server hosting the WordPress site using The Events Calendar plugin. This can lead to full system compromise, data theft, or service disruption. The CVSS score of 9.8 reflects critical impact with high confidentiality, integrity, and availability consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling comments on events to prevent exploitation, as the vulnerability requires comments to be enabled and visible. Monitor vendor channels for updates and apply patches promptly once released.