The Events Calendar Hit by a 9.8 RCE: Update to 6.17.4.1 Now (2026)

If you run The Events Calendar on WordPress, update it before you do anything else. Two critical vulnerabilities in the plugin let an attacker take over your site without logging in, and together they affect more than 600,000 active installations. The fix is version 6.17.4.1 or later, and it takes about two minutes.

Here is what is wrong, how to tell if you are affected, and what to check if you think someone already got in.

What Is Actually Wrong

Both flaws scored 9.8 out of 10 on the CVSS scale, which is the top of the range for this class of bug. Both live in the plugin’s widget-rendering code, and neither one requires a login, a registered account, or any action from you. Wordfence’s threat intelligence team found them on August 21 and 22, 2026. StellarWP acknowledged the reports on August 24 and shipped patches shortly after.

• CVE-2026-78006 (affects 6.17.4 and older). An attacker submits a crafted comment to an event page. The plugin processes the full event page, comments included, as Gutenberg blocks, so malicious block content in that comment reaches the widget-rendering code. A malformed serialized PHP payload slips past the plugin’s validation and triggers PHP object injection, which can run operating system commands as the web server user.
• CVE-2026-78159 (affects 6.17.3 and older). A different path. A specially prepared array passes the plugin’s safety check and flows into the widget template system, where it reaches a function that accepts callable PHP functions. The demonstrated impact is an administrator password reset, after which the attacker logs in, uploads a malicious plugin, and gets remote code execution.

There is a nasty detail in the first one: the attacker does not need an approved comment. WordPress lets a comment author preview their own pending comment through the moderation link, and that preview is enough to send the payload through the vulnerable code path.

Are You Affected?

Two quick checks:

• Do you run The Events Calendar? If not, you are not affected by these two flaws. Move on.
• What version is it? If you are on 6.17.4 or older, you are exposed to CVE-2026-78006. If you are on 6.17.3 or older, you are exposed to both. The patched release is 6.17.4.1.

The comment requirement only applies to the first flaw. The second one does not care whether comments are on, so disabling comments is not a complete workaround for anyone on 6.17.3 or older.

How to Fix It Right Now

Update to 6.17.4.1. That is the whole fix, and it is the only one that closes both holes.

1. Update the plugin. In your dashboard, go to Plugins and update The Events Calendar. If you use WP-CLI, run the command below.
2. Verify the version. Confirm you are on 6.17.4.1 before you consider this done.
3. Cannot update this minute? Turn off comments on your event pages as a stopgap, and undo the plugin’s “Show comments on event pages” setting. That blocks the first attack while you plan the update, but it leaves the second one open. Treat it as a bridge measured in hours, not a solution.

user@host:~$ wp plugin update the-events-calendar

Enabling Maintenance mode...
Updating plugin:  The Events Calendar
Success:  Updated 1 of 1 plugins.

wp plugin get the-events-calendar --field=version
6.17.4.1

Check Whether You Were Already Hit

The flaws were found and reported quickly, and exploit activity against them is public knowledge now. If your site ran an unpatched copy, it is worth five minutes of checking:

• Look at your administrator list. In Users, filter by Administrator and confirm every account is one you created.
• Look for plugins you did not install. An attacker who resets an admin password usually uploads something before they leave.
• Check for password reset emails you never requested, for your own account or for other admins.
• Skim your server logs for a burst of POST requests to event pages, or comments you never approved.

If anything looks wrong, treat it as a full compromise rather than a plugin bug. Reset admin passwords, rotate your WordPress salts, remove anything unfamiliar, and work through a real recovery process. Our WordPress hack recovery guide walks through that in order. If you would rather hand off the clean-up, managed hosting with a hack-fix guarantee covers the server side, though the application layer is still yours to secure.

Why This One Deserves a Fast Reaction

Two things make this worse than the average plugin advisory. First, the comment-preview trick means an attacker never has to get a comment approved, so the usual advice to “moderate your comments” does not help. Second, Wordfence’s free tier does not get a firewall rule for known exploit attempts until September 21, 2026, while paid customers got theirs on August 22. For a security-first site, your patch is the real protection, not your firewall.

It is also a good illustration of why WordPress.org’s new automated review of plugin releases matters, though it does not help you here. That system screens a release before it reaches you. It does not reach back and patch the copy already sitting on your server. For that, the update is on you.

The Questions Everyone Asks

Final Thoughts

This is one of those advisories where the action is short and the consequences are not. Update The Events Calendar to 6.17.4.1, confirm the version, and spend five minutes checking your admin accounts and plugin list. If you run a site that takes registrations or payments, do it before you do anything else today.

Disclosure: this post contains an affiliate link. If you buy through it, we may earn a commission at no extra cost to you.

About The Author

Marcus Li

Marcus Li is a web designer and marketing specialist based in Vancouver, BC. After years of helping clients build their online presence, he discovered how AI tools could level the playing field for everyday entrepreneurs. He shares what actually works, no fluff, no hype.

See author's posts