Description

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_safe_widget_instance function. This is due to insufficient protection in is_safe_widget_instance, which can be bypassed because PHP fires magic methods during its pre-parse, combined with enable_rendering_widget_copied() forging a valid wp_hash integrity attribute before unserialize() is reached. This makes it possible for unauthenticated attackers to execute code on the server. This is exploitable without authentication or approval because the plugin's V2 single-event template runs do_blocks() over buffered comment HTML, and WordPress returns a moderation-hash URL that allows an unauthenticated commenter to immediately view their own pending comment, delivering the injected block markup to the vulnerable code path before any moderation occurs. This does require comments to be enabled and visible on events.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-12T08:16:24.240Z",
  "pubdate": "2026-09-12T08:16:24.240Z",
  "executiveSummary": "The Events Calendar plugin for WordPress, in versions up to and including 6.17.4, contains a critical Remote Code Execution (RCE) vulnerability within the is_safe_widget_instance function.\nThe vulnerability stems from insecure deserialization of user-supplied data, allowing an unauthenticated attacker to execute arbitrary PHP code on the server.\nThe attack vector leverages the plugin's interaction with the WordPress comment system; specifically, the V2 single-event template processes buffered comment HTML using do_blocks().\nBecause WordPress provides an immediate moderation-hash URL for pending comments, an unauthenticated attacker can force the application to process malicious block markup before administrative moderation occurs.\nThis bypasses intended security controls, as the enable_rendering_widget_copied() function facilitates the forging of valid integrity attributes required for the unserialize() process.\nThe impact is complete system compromise, as successful exploitation results in full server-side execution of attacker-controlled code.\nThe vulnerability is accessible to any remote, unauthenticated user, provided that event comments are enabled on the target WordPress installation.",
  "technicalDetails": "The core of the vulnerability lies in an insecure deserialization flaw within the is_safe_widget_instance function of The Events Calendar. When processing widget instances, the function fails to adequately sanitize input, allowing an attacker to supply a serialized object that PHP processes during its pre-parse stage.\nThe exploitation process is initiated by the enable_rendering_widget_copied() function, which is utilized by the plugin to forge a valid wp_hash integrity attribute. This attribute is critical for bypassing the integrity checks typically guarding unserialize() calls, effectively tricking the application into processing a malicious payload as a legitimate serialized object.\nThe attack flow relies on the integration between the plugin's V2 single-event template and the native WordPress comment system. When a comment is submitted to an event, the template triggers a do_blocks() call against buffered comment HTML. Crucially, the standard WordPress behavior provides an unauthenticated commenter with a unique moderation-hash URL, allowing them to view their pending comment immediately upon submission.\nBy submitting a comment containing the forged malicious block markup, the attacker forces the application to render the buffered comment content. The do_blocks() function parses this content, which leads to the execution of the vulnerable is_safe_widget_instance logic. Because the server-side code processes the comment before it has undergone any formal moderation or filtration, the payload is delivered to the unserialization sink without resistance.\nThe PHP execution environment parses the malicious object during the pre-parsing phase, where magic methods—such as __wakeup() or __destruct()—are invoked. By crafting a POP (Property Oriented Programming) chain within the serialized object, an attacker can manipulate application execution flow, ultimately achieving Remote Code Execution (RCE).\nThis vulnerability is particularly severe because it requires no prior authentication or administrative approval. As long as the 'Allow comments' option is enabled for events, an attacker can reach the vulnerable code path via a standard POST request to the WordPress comment submission endpoint. Post-exploitation, the attacker gains the ability to execute arbitrary commands with the privileges of the web server user, leading to potential data exfiltration, site defacement, or persistent backdooring of the WordPress environment."
}