abraxas/cve-2026-78159Proof-of-concept exploit for CVE-2026-78159, an unauthenticated RCE in The Events Calendar WordPress plugin via the parse_array widget classes sink.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · CVE-2026-78159
The Events Calendar 6.17.3 — stellarwp
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
| CVE | CVE-2026-78159 · CVE.org |
| CWE | CWE-94 |
| CVSS | Critical: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Product | The Events Calendar |
| Affected | all versions through 6.17.3 (inclusive) |
| Patched | 6.17.3.1 and later |
| Auth | none (see source map) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only · vendor/client disclosure pack, not a scanner |
parse_array is the sink, not an ajax action=. HTTP is POST /wp-comments-post.php then GET the moderation-preview URL. Widget idBase is tribe-widget-events-list, not events-list.
POST/wp-comments-post.phpGET /event/lab-event/ harvest comment_post_IDPOST /wp-comments-post.php comment=<!-- wp:legacy-widget {idBase tribe-widget-events-list, instance.encoded php-serialize-base64, instance.hash 0} /-->302 Location includes unapproved=COMMENT_ID&moderation-hash=wp_hash(comment_date_gmt)GET that Location: comments_template includes the unapproved commentTemplate_Bootstrap::get_v1_single_event_template_html do_blocks($html)Service_Provider::enable_rendering_widget_copied (render_block_data) unserialize allowed_classes false, is_safe_widget_instance rejects objects only, wp_hash the plain arrayrender_block_core_legacy_widget the_widget tribe-widget-events-listWidget_List setup_arguments array_merge instance (classes survives; setup_template_vars does not overwrite it)empty featured list -> widget-events-list.php else branch components/messages.phptec_classes($classes) -> Element_Classes::parse_array string key + is_callable value -> poc_witness_78159($results) echoes POCWitness78159HTTP body of the moderation-preview GET contains POCWitness78159. Generic event HTML without that string is not it. debug.log may also append POCWitness78159.
Do this first: Update The Events Calendar to 6.17.3.1 or newer (Wordfence recommends 6.17.4.1 to also cover CVE-2026-78006).
Verify after upgrade
CVE-2026-78159-Abraxas-Labs.py against the patched build: the mapped witness must not appear.If you cannot update immediately
Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.
python3 CVE-2026-78159-Abraxas-Labs.py
Success is the witness above in the response body. Generic 200 HTML is not it.
Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.
cd lab
docker compose up --force-recreate
Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.
www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve
Plugin directory: the-events-calendar
Trac browser: plugins.trac.wordpress.org/the-events-calendar
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
# CVE-2026-78159 (structured records)
- input: `https://nvd.nist.gov/vuln/detail/CVE-2026-78159`
- CWE: CWE-94
- published: 2026-09-12T08:16:24.377
## NVD description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
## MITRE description
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
## Affected
- stellarwp The Events Calendar 0 affected
## References (JSON sources only)
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279
- https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendar
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve
- https://github.com/advisories/GHSA-9c57-9fxg-8x9j
- https://nvd.nist.gov/vuln/detail/CVE-2026-78159
## GitHub advisory
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all...
The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area.
This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.
This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.