Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Source SecurityWeek
Mentioned vulnerabilities
Fixed in 6.17.4.1 : patch affected systems as a priority.
Data as of 16 Sep 2026, 11:46 UTC
Rated Critical by Threat Radar from the SecurityWeek text
- Patch
- Available – fixed in 6.17.4.1, 6.17.3.1
What to do
AI-suggested
Both vulnerabilities have been officially patched by the vendor StellarWP. Users should upgrade The Events Calendar plugin to version 6.17.4.1 or later to remediate both issues. Specifically, version 6.17.3.1 fixes CVE-2026-78159 and version 6.17.4.1 fixes CVE-2026-78006. Sites unable to immediately update should consider disabling comments on events as a temporary mitigation for CVE-2026-78006. Patch status is confirmed by the vendor advisory.
Description
Two critical unauthenticated remote code execution (RCE) vulnerabilities affect The Events Calendar WordPress plugin versions before 6.17.3.1 and 6.17.4.1. These flaws allow attackers to execute arbitrary code and potentially take over affected WordPress sites. The first vulnerability (CVE-2026-78159) involves unauthenticated code injection via insufficient validation, patched in version 6.17.3.1. The second (CVE-2026-78006) is an unauthenticated PHP object injection exploitable if event comments are enabled, fixed in version 6.17.4.1. Approximately 240,000 sites using vulnerable versions may be exposed, though exploitation requires comments to be enabled. Both vulnerabilities lead to full site compromise if exploited.