Critical RCE in The Events Calendar WordPress Plugin <= 6.17.3
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- the events calendar (wordpress)
- Patched version
- Not yet available
The Events Calendar WordPress plugin versions up to and including 6.17.3 contain a critical remote code execution vulnerability. This affects all installations using these versions.
What happened
The vulnerability, tracked as CVE-2026-78159, allows unauthenticated remote code execution via the parse_array function. This could enable attackers to execute arbitrary code on the server. The flaw was first flagged on September 12, 2026 and confirmed on September 16, 2026. Over 200,000 WordPress sites are potentially exposed.
To assess your exposure, check the version of The Events Calendar plugin installed on your WordPress site. If it is 6.17.3 or earlier, you are vulnerable. Additionally, review comments on tribe_events posts for any suspicious activity that may indicate exploitation.
What to do about it
- Upgrade The Events Calendar plugin to a version beyond 6.17.3 immediately.
- Review comments on tribe_events posts for any suspicious activity.
- Monitor the primary sources for updates on the vulnerability and any official patches.
How 0Day would have caught this
the events calendar is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using The Events Calendar plugin version 6.17.3 or earlier, you are affected.
What should I do right now?
Upgrade to a version beyond 6.17.3 and review comments on tribe_events posts for any suspicious activity.
Is there an official patch available?
No official patch has been published yet. Monitor the primary sources for updates.