Vulnerability in The Events Calendar — CVE-2026-78159
What to do now
Update The Events Calendar to 6.17.3.1 or later.
Affected versions
- Everything up to and including 6.17.3
Affected: The Events Calendar (plugin, the-events-calendar)
What the vulnerability is
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.