EUVD-2026-65172
GHSA-9prr-67qp-hf9r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running The Events Calendar ≤6.17.2
-
DeliveryCraft serialized PHP object payload
-
ExploitSend to vulnerable plugin endpoint unauthenticated
-
ExecutionPlugin deserializes untrusted input
-
PersistPOP gadget chain triggers magic methods
-
ImpactAchieve file write / SQLi / code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that attacker-supplied data reaches the plugin's unserialize() call (the object-injection entry point) and that a usable POP gadget chain is present in the plugin, WordPress core, or another installed plugin/theme to convert object instantiation into a concrete malicious action - object injection alone is inert without a reachable gadget. Per the CVSS vector this needs no authentication (PR:N), no user interaction (UI:N), and only network access to the WordPress site (AV:N), and it applies to default installations of any version ≤6.17.2. The main limiting factor is the availability of an exploitable gadget chain on the specific target; sites with fewer plugins/themes may lack a chain that reaches high-impact sinks, reducing real-world exploitability below the 9.8 ceiling. |
| Impact | The signals are moderately consistent but incomplete. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, unauthenticated, low-complexity exploitation with full CIA impact, which is the worst-case profile for a POP chain that reaches RCE. However, PHP Object Injection is inherently conditional: without a confirmed exploitable gadget chain the practical impact may be lower than 9.8 suggests, so the score should be read as a ceiling rather than a guarantee. No EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no POC was supplied - so this is a credible high-priority issue driven by the unauthenticated vector and large install base, not confirmed in-the-wild abuse. Missing data (EPSS, exact fix version, confirmed gadget chain) should be resolved against the Patchstack advisory before final prioritization. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a public plugin endpoint containing a serialized PHP object payload built from a POP gadget chain. The plugin deserializes the input, triggering magic methods that lead to file writes, SQL injection, or code execution in the WordPress context. No POC was provided, but the AV:N/AC:L/PR:N/UI:N vector means such a request needs no login, no user interaction, and little complexity if a viable gadget chain exists on the target. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
PHP Object Injection in the WordPress plugin The Events Calendar (all versions up to and including 6.17.2) allows unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the plugin, per CVSS a network, low-complexity, no-authentication issue with high confidentiality, integrity, and availability impact (CVSS 9.8). Depending on the POP gadget chains present in the plugin, its dependencies, or other installed plugins/themes, this can escalate to arbitrary file operations, SQL injection, or remote code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch target.
RemediationAI
Upgrade The Events Calendar to the vendor's patched release above 6.17.2 as published on the plugin's WordPress.org page and referenced in the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/the-events-calendar/vulnerability/wordpress-the-events-calendar-plugin-6-17-2-php-object-injection-vulnerability); the exact fixed version is not stated in the available data and should be confirmed from the changelog before deployment. If immediate patching is not possible, apply virtual patching / WAF rules (Patchstack or an equivalent WordPress firewall) to block serialized PHP object payloads reaching the plugin's endpoints, and restrict or monitor the specific request parameters/endpoints the plugin exposes - the trade-off is that WAF signatures for object injection can be bypassed with encoding and may produce false positives on legitimate event data. As a stronger stopgap, deactivate the plugin until patched, which removes the risk entirely but disables all event/calendar functionality on the site.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-502 (Deserialization of Untrusted Data): the plugin passes attacker-controllable input into PHP's unserialize() without validation. When PHP deserializes a crafted string, it instantiates arbitrary objects whose magic methods (__wakeup, __destruct, __toString) fire automatically; an attacker chains these 'POP gadgets' from code available in the WordPress core, the plugin, or co-installed plugins/themes to reach a dangerous sink. The affected component is the Events Calendar WordPress plugin (CPE cpe:2.3:a:nexcess:the_events_calendar), a widely deployed calendar/event-management plugin; the 'nexcess' vendor token in the CPE reflects the current corporate owner (Liquid Web/Nexcess/StellarWP) of the product formerly published by Modern Tribe. The impact of a POP chain is bounded by which gadgets are actually reachable in a given installation, which is why real-world severity can vary between sites.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network object injection (AV:N/PR:N/UI:N), but AC:H because successful high impact depends on a reachable POP gadget chain that is not guaranteed on every install.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
Articles & Coverage 1
Executive ViewAI
The Events Calendar WordPress plugin through version 6.17.2 contains a critical PHP object injection vulnerability allowing unauthenticated remote attackers to execute arbitrary code on any affected WordPress site. With no vendor patch currently available and the plugin used by thousands of organizations to manage event scheduling and registrations, this represents an urgent threat to data security and site availability. Organizations must act immediately to either disable the plugin, apply compensating controls, or move to alternative solutions.
Implement Web Application Firewall filtering on requests containing serialized object notation destined for The Events Calendar plugin endpoints. Restrict direct network access to WordPress administrative interfaces and plugin configuration pages. Enable comprehensive HTTP request and response logging to detect exploitation signatures. Require multi-factor authentication for all WordPress administrative accounts. Consider deploying the plugin on isolated systems or behind an additional reverse proxy authentication layer pending patch availability. Monitor CISA KEV and vendor advisories daily for patch notification.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB