EUVD-2026-76833
GHSA-9c57-9fxg-8x9j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network RCE (PR:N, full CIA impact), but AC:H because it requires comments enabled on events plus a pre-planted crafted comment block rendered via do_blocks().
Primary rating from Vendor (Wordfence).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
Articles & Coverage 1
AnalysisAI
Remote code execution in The Events Calendar WordPress plugin (StellarWP) through version 6.17.3 lets unauthenticated attackers run arbitrary PHP on the server by abusing Element_Classes::parse_array(). A plain-array widget 'classes' payload evades the is_safe_widget_instance() object check and reaches a callable-invocation sink; the chain fires when do_blocks() renders a single-event page whose comment area contains a crafted wp:legacy-widget block. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target site has comments enabled on tribe_events (event) posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted and is reachable when the single-event page is rendered, because the chain only fires when do_blocks() processes the single-event HTML including the comment area. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects unauthenticated network RCE with full impact, which is the correct ceiling for arbitrary code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade The Events Calendar beyond 6.17.3 to the current patched release; the fix is committed in WordPress.org changesets 3667866 and 3667867 (https://plugins.trac.wordpress.org/changeset?old=3667866%40the-events-calendar and /changeset?old=3667867%40the-events-calendar), which correspond to the next tagged release (Upstream fix available as changesets; the exact released patched version is not independently confirmed from the provided data - verify against the plugin changelog before relying on a specific number). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable comments on all tribe_events posts via WordPress settings or disable The Events Calendar plugin entirely if not mission-critical to operations; review server logs and web application firewall logs for suspicious activity targeting event pages or wp:legacy-widget blocks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in The Events Calendar
View allThe Events Calendar WordPress plugin before 6.4.0.1 does not properly sanitize user-submitted content when rendering som
The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated
The events-calendar-pro WordPress plugin before 6.4.0.1, The Events Calendar WordPress plugin before 6.4.0.1 does not pr
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauth
Remote code execution in The Events Calendar plugin for WordPress (StellarWP) affects all versions up to and including 6
The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribe_has_
Blind SQL injection in The Events Calendar WordPress plugin (versions 6.15.12 through 6.16.2) by Liquid Web / StellarWP
Integrity bypass in The Events Calendar WordPress plugin allows unauthenticated attackers to mark existing Event Aggrega
The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticat
The Events Calendar WordPress plugin before 6.17.3.1 exposes unpublished site content - drafts, pending posts, and priva
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ paramete
The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all ver
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today