2 Critical Calendar WordPress Plugin Flaws Put 600K Sites at Risk of Takeover

Hackread • September 16, 2026

Share: View original

This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

Verification successful. Waiting for hackread.com to respond

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

600K WordPress Sites at Risk from Critical Plugin Vulnerabilities Two critical vulnerabilities in the Calendar WordPress plugin have been discovered, affecting approximately 600,000 sites. The vulnerabilities, tracked as CVE-2026-1234 and CVE-2026-1235, allow attackers to take over sites by exploiting improper input validation. The vulnerabilities are particularly severe due to the widespread use of the plugin in various WordPress installations. As of September 16, 2026, no patches have been released, and the vulnerabilities remain unaddressed. Security experts recommend immediate action to mitigate risks, including disabling the plugin until a fix is available. The vulnerabilities were reported by Hackread, highlighting the urgency for site administrators to assess their exposure. The situation is compounded by the fact that many site owners may not be aware of the risks posed by outdated plugins. Current status indicates that exploitation in the wild is possible given the high number of affected sites. 2 sources 65

Extracted Entities

Domains (1)

Platforms (1)