security_identifier

CVE-2026-78006

Identifier for an unauthenticated remote code execution flaw in The Events Calendar WordPress plugin arising from insufficient protection in its is_safe_widget_instance check, rated CVSS 9.8.

Current clusters

security1 publisher

An unapproved comment triggers RCE in The Events Calendar before moderation sees it

StellarWP split the fix across two releases, so a WordPress site updated on August 25 stayed open to CVE-2026-78006 until 6.17.4.1 shipped on September 10. Version data puts about 240,000 installs behind both bugs.

Publishers:securityweek.com

Reality

Evidence58
Adoption55
Hype gap+25
Incentives45
Confidence55

security2 publishers

Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs

CVE-2026-27540 lets an unauthenticated request add php to the plugin's own upload allowlist and drop a webshell. The fix shipped on February 20, and the first exploitation spike came 104 days later, on June 4.

Publishers:bleepingcomputer.comthehackernews.com

Reality

Evidence68
Adoption55
Hype gap+20
Incentives65
Confidence70