The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance() object check and reach the callable-invocation sink in ElementClasses::parsearray(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribeevents posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when doblocks() processes the single-event HTML including the comment area.