Most WordPress vulnerabilities need an attacker to already have some kind of foothold: an admin password, an open upload form, a logged-in session. CVE-2026-78006 needs none of that. It needs a comment box.
A comment field that never checks who is commenting
The Events Calendar, a StellarWP plugin used on more than 600,000 WordPress sites to publish and manage event listings, includes a function called is_safe_widget_instance meant to stop untrusted widget data from being deserialized. Wordfence found that the guard can be bypassed by forging a wp_hash integrity attribute inside the submitted data. Once that forged hash passes validation, PHP’s own magic methods run during pre-parsing, before unserialize() is even called on the rest of the attacker-controlled payload. The practical result: an unauthenticated visitor submits a comment on an event page, and the server can end up executing PHP code chosen entirely by that visitor.
The only preconditions are that comments are enabled and visible on events, and the site is using the plugin’s V2 single-event template, both of which are default or near-default configurations on a large share of installs. From there, the path runs straight to creating rogue administrator accounts, installing malicious plugins, and planting persistence that survives a plugin update.
Two critical bugs, one patch
StellarWP released version 6.17.4.1 on September 10, closing CVE-2026-78006 and a second, separately reported unauthenticated remote code execution flaw (CVSS 8.1) triggered through the widget “classes” map callable, disclosed a day earlier. Both were fixed in the same build, which is the only version to install if you run this plugin. A public proof-of-concept for CVE-2026-78006 is already circulating, which typically shortens the window between disclosure and mass scanning to days, not weeks.
Why this lands harder on European small business sites
Events plugins are disproportionately common on exactly the kind of site that runs without a dedicated security team behind it: conference organisers, venues, local government pages, membership associations, and agencies building client sites on WordPress rather than a custom stack. Comments on event pages are also routinely left open by design, since organisers want attendee questions visible. That combination, a widely deployed plugin plus a default configuration that satisfies the exploit’s preconditions, is exactly the profile that gets swept up in automated scanning within days of a public PoC.
What to do this week
Update The Events Calendar to 6.17.4.1 or later on every site where it is installed, including client sites your agency manages. If you cannot patch immediately, disable comments on event pages as a stopgap, and check existing admin accounts and installed plugins for anything unfamiliar in case exploitation already happened before the patch landed.
If you want a European team to audit your WordPress estate for plugins like this one, confirm your client sites are patched, and put monitoring in place so the next critical plugin bug gets caught before it gets exploited, contact Excello Digital. We help agencies and in-house teams keep WordPress infrastructure out of the headlines.