CVE-2026-78006-POC

POC für CVE-2026-78006 The Events Calendar <= 6.17.4 - Unauthentifizierte PHP-Object-Injection bis hin zu Remote Code Execution

#KONTAKT telegram für alle Anfragen: @soldout0O

💙 Unterstütze das Projekt

Wenn dir meine Arbeit gefällt, ziehe in Betracht, das Projekt über USDT (TRC20): TQBA72kakjCZLnJt8fJYcD7dyQCEpzNtVN zu unterstützen

The Events Calendar — Unauthentifizierte PHP-Object-Injection bis RCE

Security-Research-PoC

The Events Calendar für WordPress enthält eine unauthentifizierte PHP-Object-Injection-Schwachstelle, die zu Remote Code Execution verkettet werden kann.

Der verwundbare Codepfad umfasst:

is_safe_widget_instance()
enable_rendering_widget_copied()

Das ist wichtig, weil im gerenderten Inhalt eingebettetes Block-Markup als WordPress-Blockdaten interpretiert wird. --- ## 4. Manipulierte Blockdaten Das PoC konstruiert einen Legacy-Widget-Block, der eine serialisierte Widget-Instanz enthält. Die Forschungsimplementierung erstellt den Block unter Verwendung einer kodierten serialisierten Instanz und eines Integritätsattributs. Der verwundbare Pfad verarbeitet diese Daten letztendlich als Widget-Instanz. --- ## 5. Umgehung der Integritätsprüfung Das Verhalten `enable_rendering_widget_copied()` des Plugins kann missbraucht werden, um ein gültiges Integritätsattribut für die vom Angreifer kontrollierten Widget-Daten zu erzeugen. Dadurch kann die bösartige Widget-Instanz die erwartete Integritätsprüfung bestehen und den verwundbaren Verarbeitungspfad erreichen. --- ## 6. Unsichere Objektbehandlung Der verwundbare Schutz `is_safe_widget_instance()` ist unzureichend gegenüber dem Objekt, das über die manipulierte Widget-Instanz bereitgestellt wird. Das Objektbehandlungsverhalten von PHP kann während des Deserialisierungsprozesses Magic Methods aufrufen. Das Ergebnis ist ein ausnutzbares PHP Object Injection-Primitiv. --- ## 7. Gadget Chain Das Forschungs-PoC konstruiert WordPress-/The Events Calendar-Objekt- strukturen, die während der Deserialisierung aufrufbares Verhalten bereitstellen. Das PoC verwendet callback-orientierte Objekte und serialisierte Klassenstrukturen, um die Forschungs-Payload zu konstruieren. --- ## 8. Codeausführung Die endgültige Auswirkung ist Remote Code Execution. Das PoC enthält eine Forschungs-Webshell-Stufe und Logik zur Erstellung von Administratoren. Zur sicheren Verifizierung der Schwachstelle ist die wichtige Sicherheitsgrenze bereits durch die erfolgreiche Ausführung der verwundbaren Deserialisierungskette nachgewiesen. --- # Warum die Schwachstelle kritisch ist Die Kombination aus:```text Unauthenticated + Remote + PHP Object Injection + RCE

START | v Plugin-Version prüfen | v Voraussetzungen prüfen | v Bestätigen, dass Kommentare aktiviert sind | v Bestätigen, dass Events Kommentare bereitstellen | v In einem Labor reproduzieren | v Verwundbares Verhalten bestätigen | v Beweise und Logs aufzeichnen | v Stoppen / offenlegen``` Use the minimum level of interaction required to prove the finding. --- # Important Prerequisites The Wordfence advisory identifies the following important condition: ```text Kommentare müssen aktiviert sein und Kommentare müssen bei Ereignissen sichtbar sein``` The attack relies on the ability of an unauthenticated commenter to view their own pending comment through the WordPress moderation-hash URL. If comments are disabled or the relevant event comment path is not available, the documented unauthenticated delivery mechanism may not be reachable. --- # Platform Considerations The PoC contains environment-detection functionality. The research code attempts to identify information such as: ```text Betriebssystem Aktueller Ausführungsbenutzer Aktuelles Arbeitsverzeichnis Dokumentwurzel Server-Software HTTP-Host PHP-Informationen``` These values are useful for controlled research and understanding the impact of successful code execution. --- # Payload Architecture The serialized payload contains multiple nested PHP objects. The research implementation builds structures associated with: ```text Tribe__Utils__Callback Tribe\Utils\Element_Classes stdClass``` The serialized structures are then embedded into a WordPress legacy widget block. Conceptually: ```text PHP-Objektgraph | v Serialisiertes Objekt | v Base64-Kodierung | v Legacy-Widget-Block | v WordPress do_blocks() | v The Events Calendar | v Objekt-Deserialisierung``` --- # Stage 1 The research PoC's first stage is designed to verify that the injected object graph reaches the intended execution path. The stage contains multiple controlled callbacks used to determine whether code execution or environment disclosure occurred. The implementation includes research checks such as: ```text Aktuelles Arbeitsverzeichnis Ausführender Benutzer Dokumentwurzel Serverinformationen PHP-Informationen``` --- # Stage 2 If the initial stage does not directly establish the required persistent artifact location, the PoC contains a second-stage mechanism that attempts alternative locations. The research implementation specifically considers WordPress upload locations and document-root-related paths. --- # Administrator Stage The PoC also contains administrator creation functionality. The research implementation can construct a WordPress administrator through the vulnerable execution path. This demonstrates that successful exploitation can result in both: ```text Remote Code Execution + Persistenter WordPress-Administratorzugriff``` Administrator credentials generated during research should never be committed to source control. --- # Webshell Stage The PoC contains a webshell stage intended for controlled research. The webshell is packaged as a WordPress plugin ZIP and deployed through an authenticated WordPress administrator session established by the chain. The research implementation uses a secret token to gate shell requests. > [!CAUTION] > The webshell is an exploitation artifact. > > Use it only in an isolated laboratory or during an explicitly > authorized penetration test, and remove it immediately after testing. --- # Verification Successful vulnerability validation can be based on evidence such as: ```text Plugin-Version + Erreichbares Ereignis + Kommentarübermittlung + Moderation-Hash-Rendering + Verarbeitung des anfälligen Widgets + Nachweis kontrollierter Ausführung``` For responsible disclosure, collect only the minimum evidence required. --- # Impact Successful exploitation may allow an unauthenticated attacker to: * Execute arbitrary PHP code * Execute commands in the context of the web server * Read sensitive application information * Access environment information * Modify WordPress files * Create administrator accounts * Install malicious plugins * Establish persistence * Potentially compromise the underlying server The ultimate impact depends on the privileges of the PHP process and the hosting environment. --- # Detection Defenders should monitor for unusual activity involving: * Event comment submissions * Pending comments followed by moderation-hash access * Suspicious block markup * Legacy widget blocks * Unexpected widget instance data * Unexpected serialized PHP objects * PHP execution triggered during event rendering * Unexpected plugin installations * New administrator accounts * Unexpected PHP files * Suspicious files under `wp-content/uploads/` A compromise investigation should correlate: ```text Webserver-Logs + WordPress-Logs + Datenbankaktivität + Dateiintegrität + Administratorkonten``` --- # Indicators of Compromise Potential indicators include: ```text Unerwartete Administrator-Konten Unerwartete Plugin-Verzeichnisse Unerwartete PHP-Dateien Verdächtige Dateien in wp-content/uploads/ Unerwartete Event-Kommentare Abnormale Moderations-Hash-Anfragen Unerwartete Widget-bezogene Anfragen Unerwartete PHP-Ausführung``` Because individual indicators can have legitimate explanations, they should be investigated in context. --- # Mitigation The primary mitigation is to update **The Events Calendar** to a fixed version provided by the vendor. Until the plugin is updated, defenders should consider: * Disabling comments where operationally acceptable * Restricting public event comments * Monitoring event comment traffic * Reviewing recently created administrator accounts * Monitoring plugin installation activity * Performing file-integrity checks * Reviewing web-server logs * Reviewing WordPress logs If compromise is suspected, treat the system as potentially compromised rather than merely vulnerable. --- # Incident Response If exploitation is suspected: 1. Preserve relevant logs. 2. Identify suspicious requests. 3. Review administrator accounts. 4. Review installed plugins. 5. Inspect recently modified PHP files. 6. Inspect `wp-content/uploads/`. 7. Rotate WordPress credentials. 8. Rotate hosting/server credentials where appropriate. 9. Remove unauthorized persistence. 10. Restore trusted application files when necessary. 11. Upgrade the vulnerable plugin. 12. Continue monitoring for re-entry. --- # Responsible Disclosure When reporting this vulnerability or derivative research: * Clearly identify the affected plugin. * Include the affected version. * Include the fixed version when confirmed. * Explain the unauthenticated attack path. * Document the required prerequisites. * Provide reproducible evidence in a controlled environment. * Avoid publishing victim data. * Never publish generated administrator credentials. * Never publish live webshell URLs. --- # Research Limitations A vulnerable plugin version alone does not guarantee successful exploitation. The attack path can be affected by: * WordPress configuration * Comment settings * Event visibility * Template configuration * Security plugins * Web Application Firewalls * Reverse proxies * PHP configuration * Hosting permissions * Object caching * Network filtering Therefore, version fingerprinting should be treated as an initial indicator rather than definitive proof of exploitability. --- # Repository Safety Do not commit: ```text shells.txt admins.txt echte Ziel-URLs generierte Anmeldedaten Webshell-Dateien erfasste phpinfo-Ausgabe Datenbank-Dumps Server-Umgebungsinformationen private Testdaten``` Use synthetic laboratory targets when creating screenshots, demonstrations, or documentation. --- # Recommended Repository Structure ```text the-events-calendar-poc/ │ ├── poc.py ├── README.md ├── LICENSE ├── .gitignore │ ├── screenshots/ │ └── .gitkeep │ └── docs/ └── research-notes.md``` Keep runtime artifacts outside the repository. --- # Technical Summary ```text The Events Calendar | v V2 Single Event Template | v WordPress do_blocks() | v Legacy Widget Block | v Forged Widget Instance | v Valid Integrity Attribute | v is_safe_widget_instance() | v PHP Object Deserialization | v Magic Method Invocation | v PHP Object Injection | v Remote Code Execution``` --- # Severity **Impact:** Remote Code Execution **Authentication:** Not required **Attack Vector:** Remote **Primary Component:** The Events Calendar **Primary Vulnerable Functions:** ```text is_safe_widget_instance() enable_rendering_widget_copied()``` **Delivery Mechanism:** ```text Event-Kommentare + WordPress moderation-hash URL + V2-Event-Rendering``` --- # Key Takeaway The important aspect of this vulnerability is not simply that the plugin uses PHP serialization. The complete unauthenticated attack path is enabled by the combination of: ```text Unzureichende Widget-Validierung + PHP-Magic-Method-Verhalten + Gefälschtes Integritätsattribut + do_blocks() + Öffentliche Event-Kommentare + Moderation-Hash-Zugriff``` This combination creates an unauthenticated path to PHP Object Injection and Remote Code Execution. --- # Credits Vulnerability details and affected-version information: **Wordfence Threat Intelligence** Research PoC: **The Events Calendar PHP Object Injection / RCE research implementation** --- # References * Wordfence Threat Intelligence — The Events Calendar PHP Object Injection / RCE vulnerability * The Events Calendar * WordPress Core * WordPress Comments * WordPress Block Editor * WordPress `do_blocks()` * PHP Object Serialization / Deserialization --- # Disclaimer This repository contains security research concerning a remote-code- execution vulnerability affecting a WordPress plugin. The PoC is provided for: * Security research * Defensive validation * Authorized penetration testing * Controlled laboratory reproduction * Education Only test systems that you own or have explicit written authorization to assess. The authors are not responsible for unauthorized use of this research. --- # Keywords ```text CVE-2026-78006 The Events Calendar The Events Calendar WordPress The Events Calendar Schwachstelle The Events Calendar RCE The Events Calendar PHP Object Injection WordPress CVE-2026-78006 POC WordPress-Sicherheit WordPress-Schwachstelle WordPress RCE PHP Object Injection PHP-Deserialisierung Unauthentifizierte RCE Remote Code Execution CVE WordPress-Plugin-Sicherheit WordPress-Plugin-RCE is_safe_widget_instance enable_rendering_widget_copied do_blocks WordPress-Kommentare Moderations-Hash legacy-widget Sicherheitsforschung PoC Proof of Concept Penetrationstests```

Beliebteste

CVE-2026-78006-POC

Zusammenfassung der Schwachstelle

Warum keine Authentifizierung erforderlich ist

3. Event-Rendering

Research PoC

PoC-Funktionen

Einzelnes Ziel

Ausgabe

Empfohlene `.gitignore````gitignore

PoC results

Research Workflow