WORDPRESS · SEPTEMBER 2026 · EARLY WARNING

The Events Calendar WordPress Plugin Vulnerable to Remote Code Execution

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
CRITICAL
CVSS
9.8
Affected component
the events calendar (wordpress)
Patched version
Not yet available
CVE-2026-78159

The Events Calendar plugin for WordPress is under investigation for a critical vulnerability that could allow Remote Code Execution. Users of versions up to 6.17.3 are advised to take immediate action.

What happened

An early warning has been issued regarding a critical vulnerability in The Events Calendar plugin for WordPress. This vulnerability, tracked as CVE-2026-78159, affects all versions up to and including 6.17.3. The flaw lies in the parse_array function, which could enable unauthenticated attackers to execute code on the server.

The vulnerability was first flagged on September 12, 2026. Although there are no reports of this vulnerability being exploited in the wild, the potential impact is severe due to the possibility of Remote Code Execution. Users are urged to assess their exposure by checking their plugin versions and reviewing comments on tribe_events posts for any suspicious activity.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If the events calendar is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using The Events Calendar plugin version 6.17.3 or earlier, you are potentially affected.

What should I do right now?

Immediately upgrade The Events Calendar plugin to a version beyond 6.17.3 and review comments on tribe_events posts for any suspicious activity.

Is there an official fix available?

No official fix has been published yet. Monitor the NVD for updates on CVE-2026-78006 and CVE-2026-78159.

Sources

Join the 0Day waitlist →

← Back to all threats