The Events Calendar RCE disclosure covers two separate CVSS 9.8 unauthenticated attack chains in the widely used WordPress plugin: CVE-2026-78006 and CVE-2026-78159. Both can ultimately lead to remote code execution under the documented event-comment conditions, but their affected-version ranges and exploitation paths are different.
Direct answer: if your site runs The Events Calendar below 6.17.4.1, update it. Version 6.17.4.1 is the first release that fully addresses both chains, while WordPress.org currently lists 6.17.5 as the latest release. Wordfence says its firewall rule for free users is scheduled to become available on September 21, but firewall protection should be treated as defense-in-depth rather than a substitute for updating the plugin.
What changed with The Events Calendar RCE flaws?
Wordfence disclosed two independent vulnerability chains affecting The Events Calendar. The research shows that unauthenticated attackers can abuse attacker-controlled comment content that is later rendered through vulnerable plugin widget logic.
The exposure is not universal across every installation. The demonstrated attack paths require event comments to be enabled and visible, including the plugin setting that allows comments to appear on event pages. Administrators should therefore check both their installed version and their event-comment configuration.
Which versions are affected?
| Vulnerability | Affected versions | Severity | Primary demonstrated outcome |
|---|---|---|---|
| CVE-2026-78006 | Through 6.17.4 | CVSS 9.8 | PHP object-injection chain that can reach arbitrary operating-system command execution |
| CVE-2026-78159 | Through 6.17.3 | CVSS 9.8 | Callable-invocation chain that can reset an administrator password and enable malicious plugin upload and code execution |
The distinction matters. A site running 6.17.4 is no longer in the affected range for CVE-2026-78159, but it is still affected by CVE-2026-78006. That is why 6.17.4 is not the full remediation point.
Which version fixes both CVEs?
The Events Calendar 6.17.4.1 is the first release that fully addresses both vulnerability chains. WordPress.org now lists version 6.17.5 as the current release, so administrators should normally move to the latest supported version rather than intentionally stopping at the minimum security threshold.
Version 6.17.4.1 included additional security hardening around copied widget-instance validation. The important operational distinction is that 6.17.4.1 is the security threshold, while 6.17.5 is the newer currently available release.
Do event comments have to be enabled?
Yes, for the attack chains demonstrated by Wordfence. The attacker-controlled content originates from comments associated with event pages and reaches vulnerable rendering logic through the pending-comment preview path.
Administrators should check whether comments are enabled for events and whether The Events Calendar’s event-comment display setting is active. A site that does not satisfy the documented prerequisite may not expose the demonstrated path, but configuration should not be used as a reason to leave vulnerable plugin code installed.
How CVE-2026-78006 works
CVE-2026-78006 is the broader of the two affected-version ranges because it includes releases through 6.17.4. Wordfence describes an object-injection chain in which specially prepared comment content can reach vulnerable widget processing and ultimately be abused for arbitrary operating-system command execution.
The key reader takeaway is not the exploit implementation itself. It is that a site running 6.17.4 can still be vulnerable even though that release is newer than the fixed threshold for the second CVE.
How CVE-2026-78159 differs
CVE-2026-78159 affects releases through 6.17.3 and uses a separate callable-invocation path. The demonstrated chain can invoke functionality that resets an administrator password. From there, an attacker who obtains administrative access can upload a malicious plugin and reach remote code execution.
The two CVEs therefore should not be described as one identical technical flaw. They share the unauthenticated event-comment entry point and severe final impact, but they reach that impact through different vulnerable behaviors.
Does Wordfence Free protect sites today?
Wordfence says its firewall rule was released earlier to Premium, Care and Response customers and is scheduled to become available to Wordfence Free users on September 21, 2026.
The reviewed evidence establishes the date but not an exact rollout hour or proof that every free installation has already received the rule at the moment a reader opens this page. Wordfence Free users should verify that their firewall feed is current rather than assuming protection solely from the calendar date.
Firewall protection is not the same as patching
A firewall rule can block an attack pattern before vulnerable code is reached. A plugin update removes or changes the vulnerable code path itself. Those are different security states.
A site protected by a firewall can still be running vulnerable plugin code. Likewise, a site that has updated to a fixed version should not rely on an old firewall state as proof that it was never previously exposed. The primary remediation for these CVEs is to install a fixed The Events Calendar release.
What site owners should check now
- Open the WordPress plugin list and record the installed The Events Calendar version.
- If the version is below 6.17.4.1, update it immediately to the latest supported release.
- If the site is on 6.17.4, do not treat that version as fully patched because CVE-2026-78006 still includes 6.17.4 in its affected range.
- Check whether comments are enabled on event pages and whether The Events Calendar is configured to display event comments.
- If Wordfence is installed, verify the current firewall feed and rule state rather than relying only on the September 21 date.
- Do not use firewall coverage or disabling comments as a substitute for updating vulnerable plugin code.
- If there is evidence of suspicious administrator-password changes, unexpected plugin installation or other compromise indicators, follow the site’s incident-response process instead of treating a successful plugin update as proof that no earlier compromise occurred.
Are these vulnerabilities being exploited in the wild?
No reviewed evidence established confirmed in-the-wild exploitation of CVE-2026-78006 or CVE-2026-78159 at the time of this article.
That distinction matters. A critical unauthenticated RCE vulnerability creates serious exposure, but vulnerability severity is not proof that attackers have already compromised a specific site. TPS will treat any later exploitation evidence as a separate information-state change and update this same canonical if the reader job remains exposure and remediation.
Does 600,000+ active installations mean 600,000 vulnerable sites?
No. WordPress.org reports more than 600,000 active installations for The Events Calendar, but that installed base cannot be converted into a vulnerable-site count. Exposure depends on the installed plugin version and the documented comment configuration, and some installations will already be patched.
The 600,000+ figure is useful for understanding the plugin’s reach, not for estimating the number of compromised or exploitable sites.
What remains unknown?
The reviewed evidence does not establish a victim count, confirmed active exploitation, threat-actor attribution, a universal compromise indicator set, or the exact clock time at which the September 21 Wordfence Free firewall rule reaches every installation.
It is also possible that hosting providers or other security products have independent mitigations that were not part of the controlling evidence reviewed for this article.
What happens next?
The most important triggers are confirmed exploitation, a CISA Known Exploited Vulnerabilities listing, new Wordfence incident or firewall guidance, another security release from The Events Calendar, authoritative compromise-detection guidance, or a change to the fixed-version threshold.
Those developments should update this same URL while the primary reader task remains determining exposure and taking the correct remediation action.
Verification note
TPS reviewed Wordfence’s original vulnerability disclosure, current The Events Calendar release information on WordPress.org and the reviewed CVE records for CVE-2026-78006 and CVE-2026-78159. The software patch threshold, comment prerequisite and September 21 firewall milestone are supported by those sources; confirmed real-world exploitation was not established.