StellarWP The Events Calendar Plugin up to 6.17.4 on WordPress is_safe_widget_instance deserialization

Summaryinfo

A vulnerability was found in StellarWP The Events Calendar Plugin up to 6.17.4. It has been declared as critical. This issue affects the function is_safe_widget_instance. Executing a manipulation can lead to deserialization. This vulnerability is handled as CVE-2026-78006. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in StellarWP The Events Calendar Plugin up to 6.17.4. This vulnerability affects the function is_safe_widget_instance. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

The advisory is available at wordfence.com. This vulnerability was named CVE-2026-78006 since 08/21/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/12/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• StellarWP

Name

• The Events Calendar Plugin

Version

• 6.17.0
• 6.17.1
• 6.17.2
• 6.17.3
• 6.17.4

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion