A WordPress plugin running on more than 600,000 websites will execute an attacker's code if that attacker simply leaves a comment on an event page. No login. No account registration. No moderator approval, either.
Wordfence's automated code review system, Argus, found two separate ways to do it, and the company's threat intelligence team validated both. Chloe Chamberland and Argus are credited as the researchers on the original report, published on September 14. Both chains score 9.8 on the CVSS scale, just short of the 10.0 maximum.
A comment box wired into the block parser
The Events Calendar, built by StellarWP, renders a single event page by capturing the whole page into a buffer, comment section included, and then passing that buffer through WordPress's do_blocks() function, the routine that turns Gutenberg block markup into output. WordPress core never does this. Core parses blocks in post content only, and deliberately not in comments, because comment text arrives from strangers.
WordPress's comment sanitizer strips dangerous HTML but preserves HTML comment delimiters, and those delimiters are precisely what Gutenberg block markup is built from. A block smuggled inside a comment therefore survives sanitization and reaches the parser.
One guard should still stop this. WordPress signs a widget's stored settings with an integrity hash before unpacking them, so that only settings the site itself created get processed. The plugin removes that guard by re-signing the attacker's settings with a freshly computed, perfectly valid hash before core ever inspects them.
Two chains, one comment box
The first chain, CVE-2026-78006, defeats the plugin's own safety check on packed data. That check unpacks the payload once in a mode meant to ignore embedded objects, then asks whether any object came back. An attacker appends a broken token after a well formed object, so the parse fails, returns nothing, and the payload is declared clean. PHP has already run the object's magic methods during that parse, and that is where the code execution comes from.
The second chain, CVE-2026-78159, does not involve objects at all. A plain array payload walks straight past the object check and reaches a point where the plugin calls a PHP function the attacker gets to name. Wordfence used it to reset the password of user ID 1, the usual administrator account, then log in and upload a malicious plugin. That is total control of the site and the server under it.
Both fire through WordPress's own pending comment preview, the moderation hash link that lets you view the comment you just posted before anybody approves it.
Update to 6.17.4.1, or hide comments on events
A site is only exposed if comments are enabled and The Events Calendar's own "Show comments on event pages" option is switched on, which makes turning that option off a genuine interim mitigation for anyone who cannot update today. The fix is version 6.17.4.1. StellarWP acknowledged the first report within three days and patched that chain on August 25, four days after disclosure, then shipped the fully patched release in early September.
Wordfence customers on Premium, Care and Response received a firewall rule on August 22. Sites running the free version get the same rule on September 21, which leaves a stretch in which the vulnerable population is both publicly documented and unshielded. Neither report describes attacks in the wild, and that is the best available reason to update now rather than later. The shape is familiar on WordPress: we saw it on a near identical install base with Forminator and its 600,000 sites, and again with Elementor Pro. What changes is the plugin. What rarely changes is that somewhere in it, untrusted input reaches code that assumed it never would.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.