CVE-2026-78159: The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance() object check and reach the callable-invocation sink in ElementClasses::parsearray(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribeevents posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when doblocks() processes the single-event HTML including the comment area.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using The Events Calendar version 6.17.3 or earlier are exposed if comments are enabled on tribe_events posts. The attack path also requires at least one submitted comment containing a crafted wp:legacy-widget block.
Does an attacker need an account or user interaction?
No. The vulnerability is exploitable by an unauthenticated attacker and does not require user interaction.
When is the malicious payload triggered?
The attack chain is triggered when WordPress processes the single-event page HTML with do_blocks(), including the comment area. A crafted comment must already be present on the affected event post.