Two CVEs Enable Unauthenticated RCE in The Events Calendar Affecting 240,000 WordPress Sites

The vulnerabilities stem from insufficient input validation in comment and event rendering paths. CVE-2026-78159 allows plain-array payloads to bypass checks during single-event HTML processing. CVE-2026-78006 permits PHP object injection before moderation occurs when comments are enabled. Both chains execute without authentication, leading to full site compromise. Defiant's analysis and WordPress.org download data confirm roughly half of 600,000 installations remain exposed post-September 10 patch release.

This pattern repeats across WordPress plugins where comment systems serve as unauthenticated entry points. Similar RCE flaws in plugins like WooCommerce and Contact Form 7 have shown that moderation queues rarely block payload delivery. Procurement records and CVE databases reveal recurring failures in sanitization of array and serialized inputs, exposing millions of sites through the open-source supply chain.

StellarWP released fixes on August 25 and September 10, yet adoption lags mirror prior incidents where 40-60 percent of installations stayed vulnerable 30 days post-patch. No independent technical attribution ties exploitation to specific actors, though exploit code availability will accelerate scanning.

Sites must audit comment settings, enforce plugin updates via automated tooling, and monitor for anomalous PHP execution. Unpatched instances face takeover risk within weeks of public disclosure.