Description

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-12T08:16:24.377Z",
  "pubdate": "2026-09-12T08:16:24.377Z",
  "executiveSummary": "The Events Calendar plugin for WordPress is susceptible to an unauthenticated Remote Code Execution (RCE) vulnerability, identified in all versions up to and including 6.17.3.\nThe vulnerability originates from improper input validation within the 'parse_array' function in the 'Element_Classes' component.\nAn attacker can exploit this flaw by submitting a crafted 'wp:legacy-widget' block within a comment on a 'tribe_events' post, provided that comments are enabled.\nWhen the WordPress 'do_blocks()' function processes the rendered HTML of a single event containing the malicious comment, the payload is executed server-side.\nThis vulnerability grants unauthenticated attackers the capability to execute arbitrary code on the underlying host, potentially leading to full site compromise, unauthorized data access, and persistent backdooring of the WordPress installation.\nThe risk is critical due to the lack of required authentication and the ability to trigger the execution via standard site interaction.",
  "technicalDetails": "The vulnerability is located in the 'Element_Classes::parse_array()' function, which is responsible for processing widget classes. The root cause is a deficiency in input validation where the plugin fails to strictly verify the structure of the widget 'classes' map.\nThe security mechanism intended to prevent arbitrary code execution, 'is_safe_widget_instance()', performs an object check that can be circumvented by supplying a specifically crafted plain-array payload. Because the application logic does not enforce strict type checking or sanitization, this payload passes the validation gate and proceeds to a callable-invocation sink within the 'parse_array' method.\nThe exploitation process initiates when an attacker submits a comment to a 'tribe_events' post containing a malicious 'wp:legacy-widget' block. WordPress uses 'do_blocks()' to parse and render these blocks. When a site administrator or visitor views the single-event page, the WordPress core processes the malicious comment content.\nDuring this parsing phase, the 'parse_array' function is invoked on the malicious input. The payload bypasses the intended safety checks, allowing the attacker to provide a reference to an arbitrary callable function. The application then inadvertently executes this callable, leading to RCE in the context of the web server process.\nThe attack flow is as follows: 1) The attacker discovers an event post with comment functionality enabled. 2) The attacker crafts a payload utilizing the 'wp:legacy-widget' block format designed to trigger the vulnerable 'parse_array' logic. 3) The malicious comment is posted to the server. 4) The server parses the event page HTML via 'do_blocks()'. 5) The 'Element_Classes' component processes the class map, fails to validate the structure, and passes the attacker-controlled input to a sink. 6) The server executes the arbitrary code.\nSuccessful exploitation allows for the execution of arbitrary PHP code, enabling full control over the WordPress environment, including access to database credentials, sensitive configuration files, and the capability to modify or delete site content."
}