security_identifier

CVE-2026-78159

Identifier for an unauthenticated remote code execution flaw in The Events Calendar WordPress plugin arising from insufficient validation of a widget 'classes' map, rated CVSS 9.8.

Current clusters

security1 publisher

An unapproved comment triggers RCE in The Events Calendar before moderation sees it

StellarWP split the fix across two releases, so a WordPress site updated on August 25 stayed open to CVE-2026-78006 until 6.17.4.1 shipped on September 10. Version data puts about 240,000 installs behind both bugs.

Publishers:securityweek.com

Reality

Evidence58
Adoption55
Hype gap+25
Incentives45
Confidence55

security2 publishers

Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs

CVE-2026-27540 lets an unauthenticated request add php to the plugin's own upload allowlist and drop a webshell. The fix shipped on February 20, and the first exploitation spike came 104 days later, on June 4.

Publishers:bleepingcomputer.comthehackernews.com

Reality

Evidence68
Adoption55
Hype gap+20
Incentives65
Confidence70