company

StellarWP

Software company that builds and maintains commercial WordPress plugins, among them The Events Calendar.

Current clusters

An unapproved comment triggers RCE in The Events Calendar before moderation sees it

StellarWP split the fix across two releases, so a WordPress site updated on August 25 stayed open to CVE-2026-78006 until 6.17.4.1 shipped on September 10. Version data puts about 240,000 installs behind both bugs.

Publishers:securityweek.com

Reality

Evidence58
Adoption55
Hype gap+25
Incentives45
Confidence55

security2 publishers

Wordfence blocked 100,000 exploit attempts against a WooCommerce plugin with 6,000 installs

CVE-2026-27540 lets an unauthenticated request add php to the plugin's own upload allowlist and drop a webshell. The fix shipped on February 20, and the first exploitation spike came 104 days later, on June 4.

Publishers:bleepingcomputer.comthehackernews.com

Reality

Evidence68
Adoption55
Hype gap+20
Incentives65
Confidence70