The Events Calendar EUVD-2026-76833

Exploitation requires that the target site has comments enabled on tribe_events (event) posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted and is reachable when the single-event page is rendered, because the chain only fires when do_blocks() processes the single-event HTML including the comment area. No authentication is required (PR:N). Limiting factors: sites that disable comments on events, moderate/strip block markup in comments, or do not render the vulnerable V2 single-event template with the comment area are not exploitable; comment moderation that prevents the malicious block from ever being rendered also breaks the chain.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) reflects unauthenticated network RCE with full impact, which is the correct ceiling for arbitrary code execution. However, the description imposes real preconditions that the AC:L rating understates: the target must have comments enabled on tribe_events posts AND at least one comment carrying a crafted wp:legacy-widget block must already have been submitted and reach rendering. That makes practical exploitation meaningfully harder than a raw 9.8 suggests - I would assess AC:H. No EPSS score, KEV entry, or public POC is present in the provided data, so there is no evidence of active exploitation; treat this as a high-severity-but-conditionally-reachable issue rather than a confirmed mass-exploitation event. Given the plugin's very large install base, patching remains a clear priority for any site that allows event comments.

On a site running The Events Calendar ≤6.17.3 with comments enabled on events, an unauthenticated attacker submits a comment on an event post containing a crafted wp:legacy-widget block whose widget 'classes' map is a plain array carrying a callable. When any visitor loads that single-event page, do_blocks() parses the comment HTML and Element_Classes::parse_array() invokes the attacker-supplied callable, executing PHP as the web server. No public POC is noted in the available data.