---
id: CVE-2026-78159
title: >-
  The The Events Calendar plugin for WordPress is vulnerable to Remote Code
  Execution in all versions up to, and including, 6.17.3 via the parse_array
  function
summary: >-
  The The Events Calendar plugin for WordPress is vulnerable to Remote Code
  Execution in all versions up to, and including, 6.17.3 via the parse_array
  function. This is due to insufficient validation of the widget 'classes' map,
  allowing a…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: stellarwp
product: The Events Calendar
affected:
  - the_events_calendar <= 6.17.3
published: '2026-09-12'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T17:17:51.410'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78159'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendar
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
  - exploit-available
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-14T16:10:22.569007Z'
epss: 0.01394
epssPercentile: 0.7118
ingestedAt: '2026-09-14T15:23:07.480Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/abraxas/CVE-2026-78159'
  checkedAt: '2026-09-25T08:21:14.358Z'
exploitAvailable: true
---

## Overview

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.