Two critical flaws in the popular The Events Calendar WordPress plugin could let attackers fully take over vulnerable websites. The bugs, CVE-2026-78159 and CVE-2026-78006, affect versions before 6.17.3.1 and 6.17.4.1 respectively and can lead to unauthenticated remote code execution if comments on events are enabled and visible; WordPress data suggests roughly 240,000 sites may still be exposed to at least one of the issues.
Why it matters: Site owners could lose full control of their WordPress servers, putting website content, user data, and linked systems at risk. Organizations using The Events Calendar should update immediately to the fixed versions and review whether event comments are enabled.
Ionut Arghire
2026.09.16
100% relevant
This article appears to be the establishing report for these two newly highlighted The Events Calendar plugin vulnerabilities, including the CVE IDs, affected versions, patch releases, and estimated exposure.
← Back to all stories