What changed
Wordfence disclosed two independent unauthenticated remote-code-execution chains in The Events Calendar, a WordPress plugin with more than 600,000 active installations. CVE-2026-78006 affects versions through 6.17.4 and can reach operating-system command execution through PHP object injection. CVE-2026-78159 affects versions through 6.17.3 and can abuse an arbitrary-callable path to reset an administrator password, after which a malicious plugin can be installed. Both known chains use attacker-controlled event-comment content and WordPress's pending-comment preview mechanism, so the comment does not need moderator approval. Version 6.17.4.1, released September 10, contains the complete fix.
Why it matters
This is an unusually practical WordPress attack path: no account, approved comment or victim click is required once comments are enabled and shown on event pages. The version boundary also creates an operational trap. The project shipped earlier widget-validation hardening and then 6.17.4, but 6.17.4 still remains affected by CVE-2026-78006; operators must verify the fourth version component and reach at least 6.17.4.1. Independent reporting also indicates that a substantial installed population remained on older versions after disclosure, although the exact number of exploitable sites depends on whether event comments are enabled.
A pending comment can become the delivery mechanism
The known exploit path relies on The Events Calendar's V2 single-event template processing buffered comment HTML with WordPress block rendering. WordPress lets an unauthenticated commenter immediately view their own pending comment through a moderation-hash URL. That means crafted block markup can reach the vulnerable widget-rendering path before a moderator approves the comment. The target must have comments enabled and visible on event pages for the documented chain.
The two chains reach compromise differently
CVE-2026-78006 is a PHP object-injection path. Wordfence says the plugin's widget-instance safety check can be bypassed because PHP magic methods can fire during parsing, while another plugin path can generate a valid integrity hash for attacker-controlled widget data before unsafe deserialization. CVE-2026-78159 instead reaches an arbitrary-callable primitive; Wordfence demonstrated resetting an administrator password and then using administrator access to install malicious PHP code.
6.17.4 is not the safe version
The patch history is easy to misread. Earlier 6.17.x releases hardened copied widget-instance validation, and CVE-2026-78159 was addressed before the final object-injection chain was closed. CVE-2026-78006 still affects 6.17.4. The complete remediation boundary is 6.17.4.1 or later, so inventory or management systems that truncate a fourth-level version component can report a dangerously misleading result.
Large installed base, uncertain exploitable population
WordPress.org lists more than 600,000 active installations. SecurityWeek reported WordPress version telemetry suggesting roughly 240,000 sites were on versions older than 6.17 around disclosure, while subsequent downloads imply many sites were updating. Those figures do not equal confirmed vulnerable or compromised sites: the known chains also require the relevant event-comment configuration, and no mass-exploitation campaign had been confirmed in the reporting reviewed for this dossier.