WordPress Calendar Plugin Patches Fix Security Gaps
Developers have released critical updates to resolve two remote code execution flaws in the Events Calendar plugin.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you feel responsible for managing security updates on your own website, or the plugin developers?
Security patches released on August 26 and September 10 address critical remote code execution vulnerabilities in the WordPress Events Calendar plugin. Approximately 240,000 active websites currently remain at risk due to a lack of necessary plugin updates.
Why it matters
The vulnerabilities stem from the plugin processing unmoderated user input through privileged code before completing essential authentication and authorization checks. Because public proof-of-concept code exists, these unpatched sites face a heightened risk of unauthorized administrative access or malicious payload execution.
CVE-2026-78159 was resolved in version 6.17.3.1, while CVE-2026-78006 required the version 6.17.4.1 update. Roughly 240,000 installations currently lack these protections.
The details
CVE-2026-78159 permitted attackers to use is_callable() to trigger unauthorized admin password resets, while CVE-2026-78006 allowed the execution of serialized PHP payloads via unauthenticated comment preview links. Disabling comments on event pages effectively removes the attack vector for both flaws.
Timeline
August 26, 2026: Version 6.17.3.1 patch released for CVE-2026-78159.
September 10, 2026: Version 6.17.4.1 patch released for CVE-2026-78006.
The Tech Race
The plugin vulnerability follows a recurring pattern of security deficits common to widely used third-party extensions within the WordPress plugin ecosystem. This incident highlights persistent maintenance challenges, mirroring broader industry struggles with software supply chain security.
Website administrators should update the Events Calendar plugin immediately to ensure their site is protected against unauthorized administrative access. If an immediate update is not possible, disabling comments on event pages serves as a temporary safeguard against these specific threats.
The takeaway
Maintaining current software versions is essential for preventing the exploitation of known vulnerabilities in widely used plugins. Web developers should prioritize regular plugin audits to identify and secure at-risk software components in their environments.
Further reading
For more on staying secure, visit our Cybersecurity section.
Source note: This article includes information reported by Cybersecurity Insiders.
Live Poll
Do you feel responsible for managing security updates on your own website, or the plugin developers?
