Security1 publisher2 min readPublished
An unapproved comment triggers RCE in The Events Calendar before moderation sees it
StellarWP split the fix across two releases, so a WordPress site updated on August 25 stayed open to CVE-2026-78006 until 6.17.4.1 shipped on September 10. Version data puts about 240,000 installs behind both bugs.
The Watch · Security desk
What happened
- CVE-2026-78006 is an unauthenticated PHP object injection bug that can be exploited only where comments on events are enabled and visible.
- WordPress data shows about 240,000 sites running builds older than 6.17, which are affected by both vulnerabilities, out of more than 600,000 active installations.
- The plugin was downloaded just over 300,000 times between September 10 and 14, which SecurityWeek says suggests roughly half of installations may still be affected by CVE-2026-78006.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision A patch check that stops at 6.17.3.1, or at the August 25 date, will pass sites that are still open to the object injection bug. The version to confirm on every host is 6.17.4.1.
- exposure Any site on a pre-6.17.4.1 build with event comments visible is reachable by an anonymous request. That request needs no login and no approved comment to get code running.
- constraint The stopgap available to a site that cannot update tonight is switching event comments off, which drops comment functionality on every event page until the plugin is upgraded.
- contradiction The two exposure estimates in the reporting measure different things: version telemetry gives about 40 percent behind on both bugs, a five-day download count gives roughly half still open to the newer one, and the comment setting that decides reachability sits outside both.
CVE-2026-78006 is a PHP object injection bug that fires before a human ever sees the comment. An unauthenticated visitor submits the payload, the plugin hands it to the vulnerable function, and the code runs ahead of moderation [8]. Approval comes afterward, once the code has already run. Defiant, the WordPress security firm whose analysis SecurityWeek cites, says the two flaws are independent exploitation chains and each one ends in remote code execution and complete compromise of the WordPress installation [10][18].
The other route runs through validation. CVE-2026-78159 lets an attacker inject a plain-array payload that bypasses checks and executes during the processing of single-event HTML, including the comment area [5]. StellarWP closed that one in version 6.17.3.1 on August 25 [6]. The object injection bug stayed open another 16 days, until 6.17.4.1 shipped on September 10 [9][15].
WordPress version data puts about 240,000 sites on builds older than 6.17 [11]. Against more than 600,000 active installs, that is roughly 40 percent of the base carrying both bugs [2][14]. The figure for the second bug alone is softer. Just over 300,000 downloads across the five days from September 10 to 14 works out to about half the install base [12][19][16], and SecurityWeek presents it as a suggestion that roughly half of installations may still be affected by CVE-2026-78006 [12]. Download counters record fetches, including new installs and repeated pulls from the same site.
How many sites an attacker can actually reach is a different question. SecurityWeek says it is unclear how many are vulnerable, because exploitation of both defects requires that comments are enabled in the plugin [13]. The report from SecurityWeek does not mention exploitation attempts against either CVE [17]. Version strings are all WordPress.org publishes, and the comment setting on any given site sits outside that data.
What to watch
- Blocked-attempt counts from Defiant against either CVE would move this from patch hygiene to an active campaign.
- A public proof of concept for the plain-array payload path in CVE-2026-78159.
- Later September download figures showing whether the pre-6.17 population falls below 240,000.