On 12 September 2026 two CVE records were published for the plugin The Events Calendar, which has 600,000+ active installations. Both describe code execution on the server by a person without an account on the site. Wordfence, which issued the records, rates them 9.8 on CVSS. CVE-2026-78006 affects all versions up to and including 6.17.4, and CVE-2026-78159 affects versions up to and including 6.17.3. Version 6.17.4.1, released on 10 September, is the first one outside both ranges.
Are you affected by the flaws in The Events Calendar?
Open Plugins > Installed Plugins and look at the version next to The Events Calendar. If it is 6.17.4 or lower, the plugin is in the range of at least one of the two records. From version 6.17.4.1 up, it is outside both.
In both records the attack goes through comments. According to them, a specially crafted comment reaches the code that processes the blocks on the event page. CVE-2026-78006 requires comments to be enabled and visible on events. The comment does not need to be approved, because the harmful code runs before moderation. CVE-2026-78159 requires comments to be enabled for events and at least one comment with a specially crafted wp:legacy-widget block to have been submitted.
Open an event page on your site. If there are comments or a comment form under it, the described condition applies to you. If there are not, the site does not meet it, but update anyway, because comments can be turned on with one setting.
What to do
- Update The Events Calendar to 6.17.4.1 from
Plugins > Installed Pluginsor from WP Toolkit in cPanel. Then check the version once more. - If you cannot update right away, turn off comments on events until you do. Both records require them to be on.
- Search
Commentsfor the textwp:legacy-widgetin the All, Pending and Spam views. CVE-2026-78159 requires such a comment, so one is a trace of an attempted attack. Not finding one does not prove there were no attempts. If you find one, write to your host's support.
If automatic plugin updates are on, your site may already have received 6.17.4.1, since the version came out two days before the records became public. Check it again anyway.
What we do
If you do not want to follow such announcements yourself, with vulnerability (CVE) monitoring we match the plugins, themes and WordPress on your site against vulnerability databases and tell you what to update before anyone exploits it. The site can be hosted anywhere. If you want us to add it, write to us through the inquiry form.
Frequently asked questions
What are CVE-2026-78006 and CVE-2026-78159?
Two vulnerabilities in The Events Calendar, a WordPress plugin, published on 12 September 2026. Both let a person without an account on the site run code on the server, and Wordfence rates them 9.8 on CVSS. CVE-2026-78006 affects all versions up to and including 6.17.4, CVE-2026-78159 affects versions up to and including 6.17.3.
Which version of The Events Calendar fixes the flaws?
The Events Calendar 6.17.4.1, released on 10 September 2026. It is the first version outside the range of both records. Version 6.17.4 is not enough, because CVE-2026-78006 still covers it.
How do I check which version of The Events Calendar I have?
In wp-admin open Plugins > Installed Plugins and look at the version next to The Events Calendar. If it is 6.17.4 or lower, the plugin falls under at least one of the two vulnerabilities.
Is my site affected if events have no comments?
The attack on both The Events Calendar flaws goes through a specially crafted comment, so both records require comments on events to be enabled. If there are no comments and no comment form under your event pages, the condition is not met. Update the plugin anyway, since comments can be switched on with one setting.
Does manual comment approval protect me?
No. With CVE-2026-78006 in The Events Calendar the comment does not need to be approved, because the harmful code runs before moderation. Submitting the comment is enough.
What if I cannot update the plugin right away?
Turn off comments on events in The Events Calendar until you can update to 6.17.4.1. Both CVE records require comments to be on. Once you have updated, check the version again.
How can I tell whether someone has tried the attack on my site?
Search Comments for the text wp:legacy-widget in the All, Pending and Spam views. CVE-2026-78159 needs a comment with that block, so finding one is a trace of an attempted attack. Not finding one does not prove there were no attempts. If you do find one, write to your host's support.
Has the plugin already updated itself if automatic updates are on?
It may have. The Events Calendar 6.17.4.1 came out on 10 September 2026, two days before the vulnerabilities became public, so a site with automatic plugin updates may already be on it. Check the version under Plugins > Installed Plugins anyway.