Buttondown

Critical RCE Vulnerability in The Events Calendar Plugin for WordPress

First seen 13 Sep 2026, 02:40 UTC • •64.5

Article Content

1 / 6

Browse articles

ThreatCluster •September 13, 2026 at 03:42 UTC

•The Events Calendar plugin is vulnerable to RCE in versions up to 6.17.4.
•Exploits can be executed by unauthenticated attackers via the is_safe_widget_instance function.
•723 attacks targeting this vulnerability were blocked by Wordfence in the last 24 hours.

The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution (RCE) in all versions up to and including 6.17.4. This vulnerability arises from the is_safe_widget_instance function, which lacks sufficient protection, allowing unauthenticated attackers to execute code on the server. The exploit can be triggered through the plugin's V2 single-event template, which processes buffered HTML without proper moderation. Wordfence reported blocking 723 attacks targeting this vulnerability within the last 24 hours. The vulnerability is categorized under CVE-2026-6174. Users of the plugin are urged to update to the latest version to mitigate risks. As of now, no active exploitation has been confirmed, but the potential for exploitation is significant due to the nature of the vulnerability.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-12

Vulnerability disclosed

Wordfence reported a critical RCE vulnerability in The Events Calendar plugin affecting versions up to 6.17.4.

2026-09-12

723 attacks blocked

Wordfence blocked 723 attempts to exploit the RCE vulnerability within 24 hours of disclosure.

2026-09-13

Further reporting on vulnerability

Buttondown highlighted the same RCE vulnerability in their daily CVE report, confirming its critical nature.

More articles in this cluster (5)

Threat Graph

11 entities, 13 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Remote Code Execution
Zero-day Exploit
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution

Weakness (2)

CWE-20 - Improper Input Validation
Cwe-502 - Deserialization Of Untrusted Data

Indicator (3)

plugins.trac.wordpress.org
wordfence.com
[email protected]

Affected Platform (2)

PHP
WordPress

Relationships

Remote Code Execution targets PHP
Remote Code Execution targets WordPress
Zero-day Exploit targets PHP
Zero-day Exploit targets WordPress
T1190 - Exploit Public-Facing Application targets PHP
T1190 - Exploit Public-Facing Application targets WordPress
T1203 - Exploitation for Client Execution targets PHP
T1203 - Exploitation for Client Execution targets WordPress
Remote Code Execution related to CWE-20 - Improper Input Validation
Remote Code Execution related to Cwe-502 - Deserialization Of Untrusted Data
Remote Code Execution related to plugins.trac.wordpress.org
Remote Code Execution related to wordfence.com
Remote Code Execution related to [email protected]

Continue Reading

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…

Critical GitLab Vulnerabilities Exploited Within Hours of Disclosure On September 10, 2026, GitLab released patches for critical vulnerabilities CVE-2026-85706 and CVE-2026-87719. CVE-2026-85706, a path traversal flaw, allows unauthenticated users to read arbitrary files from GitLab servers, while CVE-2026-87719 enables credential theft via insecure deserialization. Both…