Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

As cited

Copy frozen at 2026-09-14 20:02 UTC (site build).

vulnerabilities

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus identified two independent critical unauthenticated remote code execution vulnerability chains in The Events Calendar WordPress plugin affecting over 600,000 sites. The first chain exploits PHP object injection through a flawed validation routine in the widget-rendering pipeline, while the second bypasses that guard entirely by abusing an arbitrary callable invocation to reset administrator credentials. Both vulnerabilities require only that event pages have comments enabled and are triggered through pending-comment preview URLs without moderator approval, allowing attackers to achieve complete site takeover, data theft, and malware deployment. StellarWP released initial patches on August 25 and September 10, 2026, with version 6.17.4.1 fully addressing both issues.

Why it matters: WordPress administrators running The Events Calendar with comments enabled on event pages face immediate unauthenticated remote code execution risk from anonymous attackers; update to version 6.17.4.1 immediately, or apply Wordfence firewall rules (premium users received protection August 22, free users will receive it September 21).

Source published

2026-09-14 16:53 UTC

First seen by Cybersecurity Tracker

2026-09-14 19:34 UTC