CVE-2026-78159

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

• CWE-94

• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendar
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar
• https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve

Published

Sep 12, 2026

Last Modified

Sep 14, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78153The Restrict User Access WordPress plugin before 2.8.1 does …5.3
• CVE-2026-78154Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-78155privilege escalation in StackGres operator allows a low-priv…9.9
• CVE-2026-78156A security vulnerability has been detected in Open5GS 2.8.0.…7.4
• CVE-2026-78157A vulnerability was detected in Open5GS 2.8.0. This affects …7.4
• CVE-2026-78158A flaw has been found in Open5GS 2.8.0. This vulnerability a…6.3
• CVE-2026-7816OS command injection (CWE-78) vulnerability in pgAdmin 4 Imp…8.8
• CVE-2026-78160A vulnerability has been found in Dolibarr ERP up to 18.0.10…6.3
• CVE-2026-78161A vulnerability was found in warmcat libwebsockets 4.5.0. Im…7.3
• CVE-2026-78166A security flaw has been discovered in provectus kafka-ui up…6.3
• CVE-2026-78167A weakness has been identified in EFM ipTIME T16000M 14.20.2…10
• CVE-2026-78168A security vulnerability has been detected in EFM ipTIME T24…9.8