The Events Calendar CVE-2026-78006

Requires that comments are enabled AND visible on event posts in The Events Calendar's V2 single-event template - this is the explicit precondition stated in the description. No authentication, account, or moderator approval is needed (the WordPress moderation-hash URL lets the unauthenticated commenter view their own pending comment immediately), and no user interaction by a victim is required. Exploitation is limited to sites running an affected version (≤6.17.4) that use the V2 templates and permit public event comments; sites with event comments disabled or hidden from anonymous visitors are not reachable via this path.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is consistent with the description of unauthenticated network-based RCE, and the vulnerable code path and gadget mechanics are documented at the source-line level, lowering the barrier to weaponization. The most important caveat is a configuration dependency the raw score does not capture: exploitation requires comments to be enabled AND visible on events, so sites that disable event comments are not exploitable through this vector - this is a meaningful real-world limiter. No CISA KEV listing and no confirmed public POC are present in the input, so there is no evidence of active exploitation yet, but the combination of unauthenticated access, a very popular plugin, and a fully-described bypass means any operator running an affected version with comments enabled should treat patching as urgent. EPSS was not provided, so probabilistic exploitation likelihood cannot be quantified here.

An unauthenticated attacker posts a comment on a public event containing a crafted Gutenberg block whose attributes embed a serialized PHP object gadget chain with a forged wp_hash. WordPress returns a moderation-hash URL letting the attacker immediately view their own pending comment, which triggers do_blocks() over the buffered comment HTML; the forged hash passes is_safe_widget_instance and PHP fires the gadget's magic methods during pre-parse, reaching unserialize() and executing attacker code as the web server user - all before any moderator reviews the comment.