CVE-2026-78265: WordPress The Events Calendar plugin <= 6.17.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress The Events Calendar pluginto a version that resolves this vulnerability.Fixed in 6.17.3
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. The supplied vector indicates it can be reached over the network with low attack complexity and no user interaction.
Which installations are affected?
The affected component is The Events Calendar plugin, with versions up to and including 6.17.2 identified as vulnerable. The provided information does not state whether any particular plugin configuration is required.
What is the potential impact?
The vulnerability is rated critical with a 9.8 score and is assessed as having high confidentiality, integrity, and availability impact. It could expose affected sites to severe compromise outcomes.