WordPress Events Calendar Plugin Remote Code Execution Flaw

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Events Calendar plugin for WordPress contains a critical remote code execution vulnerability (CVSS 9.8) affecting all versions up to 6.17.3. The vulnerability exists in the parse_array function, where insufficient validation of widget 'classes' parameters allows attackers to bypass security checks and invoke arbitrary code execution. This is particularly severe because it requires no authentication, meaning any unauthenticated attacker can exploit this vulnerability against any WordPress site running the vulnerable plugin. With over 700,000+ active installations, this affects a massive portion of the WordPress ecosystem and represents an immediate threat to website availability, data integrity, and potential lateral movement into broader infrastructure.

Casky's 323 mapped security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK Initial Access (TA0001) and Execution (TA0043) techniques. Practitioners using Casky would identify detection opportunities including: suspicious widget class parameter values containing serialized objects or callable arrays in HTTP requests to WordPress plugin endpoints; unusual function invocation attempts within the Events Calendar plugin namespace; unexpected code execution originating from widget initialization routines; and anomalous process spawning or system calls triggered during widget parsing operations. By correlating these indicators with CWE-94 (Improper Control of Generation of Code) patterns, security teams can detect both reconnaissance attempts probing widget validation logic and active exploitation attempts, enabling rapid response before malicious code achieves execution on compromised servers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78159.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-78159

Casky has 323 skills that investigate the attack patterns behind CVE-2026-78159. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn