Executive brief
The Events Calendar is a popular WordPress plugin that manages event scheduling and display. This vulnerability allows unauthenticated attackers to execute arbitrary code on websites running vulnerable versions, provided comments are enabled on event posts and a malicious comment has been submitted. Exploitation could lead to full site compromise, data theft, and server takeover.
Technical details
The vulnerability is a remote code execution flaw in the Element_Classes::parse_array() function caused by insufficient validation of widget class maps. Attackers can craft a plain-array payload that bypasses the is_safe_widget_instance() object type check, allowing it to reach the callable-invocation sink. The attack vector requires that the target site has comments enabled on tribe_events posts and contains at least one comment with a malicious wp:legacy-widget block; exploitation is triggered when do_blocks() processes the single-event HTML including comments. The vulnerability affects all versions up to and including 6.17.3. No patch details are provided in the advisory.
Affected products
- Modern Tribe The Events Calendar up to and including 6.17.3
Timeline
- 2026-09-12: disclosed: CVE-2026-78159 published