---

# 受影响的插件

**插件：** The Events Calendar

**漏洞：** 未认证的 PHP 对象注入导致
远程代码执行

**受影响版本：** 根据 Wordfence 公告，所有版本直至并包括 **6.17.4**。

> [!IMPORTANT]
> 当前随此仓库发布的研究 PoC 内部标识为针对 `<= 6.17.2`。
>
> 上述版本范围遵循 Wordfence 公告
> （`<= 6.17.4`）。在测试部署之前，请始终对照
> 供应商公告核实确切的受影响/修复版本。

---

# 根本原因

该易受攻击的行为与
小部件安全检查及 PHP 对象反序列化行为之间的交互有关。

涉及的关键函数包括：```text
is_safe_widget_instance()
enable_rendering_widget_copied()

提交评论后，WordPress 可以提供一个未认证的
moderation-hash URL，允许评论者查看自己待审核的
评论。

这为精心构造的区块标记创建了一个未认证的投递机制。

---

# 技术说明

## 1. 评论提交

攻击者提交一条与事件关联的评论。

该评论无需被批准。

关键特性在于 WordPress 可以通过
moderation-hash 机制暴露该评论。

---

## 2. Moderation-Hash 访问

WordPress 向评论者提供一个 URL，允许评论者
查看自己待审核的评论。

这意味着攻击者无需等待审核即可
到达存在漏洞的渲染路径。

概念上：```text
POST Comment
     |
     v
Pending Comment
     |
     v
Moderation Hash
     |
     v
Unauthenticated Access

这一点很重要，因为嵌入在渲染内容中的区块标记会被解释为 WordPress 区块数据。

---

## 4. 构造的区块数据

PoC 构造了一个包含序列化小工具实例的旧式小工具区块。

研究实现使用编码后的序列化实例和完整性属性来构建该区块。

易受攻击的路径最终将此数据作为小工具实例进行处理。

---

## 5. 完整性绕过

该插件的 `enable_rendering_widget_copied()` 行为可被滥用，从而为攻击者控制的小工具数据生成有效的完整性属性。

这使得恶意小工具实例能够通过预期的完整性检查，并到达易受攻击的处理路径。

---

## 6. 不安全的对象处理

易受攻击的 `is_safe_widget_instance()` 保护不足以抵御通过构造的小工具实例所提供的对象。

PHP 的对象处理行为可在反序列化过程中调用魔术方法。

其结果是可利用的 PHP 对象注入原语。

---

## 7. 利用链

研究 PoC 构造了 WordPress / The Events Calendar 对象结构，这些结构在反序列化期间提供可调用行为。

PoC 使用面向回调的对象和序列化类结构来构造研究载荷。

---

## 8. 代码执行

最终影响是远程代码执行。

PoC 包含一个研究用 webshell 阶段和创建管理员的逻辑。

为了安全地验证漏洞，重要的安全边界已通过成功执行易受攻击的反序列化链得到证明。

---

# 为什么该漏洞至关重要

以下因素的结合：```text
Unauthenticated
       +
Remote
       +
PHP Object Injection
       +
RCE

该实现通过分阶段载荷投递与验证来执行漏洞利用链。

PoC 源码对其架构的描述如下：```text
payload building
        |
        v
stage 1
        |
        v
verification
        |
        v
stage 2

单目标工作流适用于：

* 本地实验环境
* 预发布系统
* CVE 复现
* 供应商测试
* 授权渗透测试
* 安全研究

---

# URL 列表

异步运行器还支持 URL 列表。

输入格式为：```text
one URL per line

空行和注释可以被忽略。

运行器加载目标，并使用配置的线程/并发数并发处理它们。

---

# 并发处理

该 PoC 支持对多个目标进行并发处理。

概念上：```text
                 URL LIST
                    |
        +-----------+-----------+
        |           |           |
        v           v           v
     Worker 1    Worker 2    Worker 3
        |           |           |
        v           v           v
      Target      Target      Target
        |           |           |
        +-----------+-----------+
                    |
                    v
                 Results

`shells.txt` 包含已发现的上传 shell URL。

`admins.txt` 包含管理员结果信息，格式如下：```text
url | user | pass

START
                  |
                  v
          验证插件版本
                  |
                  v
          验证前置条件
                  |
                  v
       确认评论功能已启用
                  |
                  v
       确认事件会暴露评论
                  |
                  v
          在实验环境中复现
                  |
                  v
       确认存在漏洞行为
                  |
                  v
       记录证据和日志
                  |
                  v
          停止 / 披露```

Use the minimum level of interaction required to prove the finding.

---

# Important Prerequisites

The Wordfence advisory identifies the following important condition:

```text
必须启用评论
并且
评论必须在事件上可见```

The attack relies on the ability of an unauthenticated commenter to view
their own pending comment through the WordPress moderation-hash URL.

If comments are disabled or the relevant event comment path is not
available, the documented unauthenticated delivery mechanism may not be
reachable.

---

# Platform Considerations

The PoC contains environment-detection functionality.

The research code attempts to identify information such as:

```text
操作系统
当前执行用户
当前工作目录
文档根目录
服务器软件
HTTP 主机
PHP 信息```

These values are useful for controlled research and understanding the
impact of successful code execution.

---

# Payload Architecture

The serialized payload contains multiple nested PHP objects.

The research implementation builds structures associated with:

```text
Tribe__Utils__Callback
Tribe\Utils\Element_Classes
stdClass```

The serialized structures are then embedded into a WordPress legacy
widget block.

Conceptually:

```text
PHP 对象图
       |
       v
序列化对象
       |
       v
Base64 编码
       |
       v
旧版小工具区块
       |
       v
WordPress do_blocks()
       |
       v
The Events Calendar
       |
       v
对象反序列化```

---

# Stage 1

The research PoC's first stage is designed to verify that the injected
object graph reaches the intended execution path.

The stage contains multiple controlled callbacks used to determine
whether code execution or environment disclosure occurred.

The implementation includes research checks such as:

```text
当前工作目录
执行用户
文档根目录
服务器信息
PHP 信息```

---

# Stage 2

If the initial stage does not directly establish the required persistent
artifact location, the PoC contains a second-stage mechanism that
attempts alternative locations.

The research implementation specifically considers WordPress upload
locations and document-root-related paths.

---

# Administrator Stage

The PoC also contains administrator creation functionality.

The research implementation can construct a WordPress administrator
through the vulnerable execution path.

This demonstrates that successful exploitation can result in both:

```text
远程代码执行
+
持久化 WordPress 管理员访问权限```

Administrator credentials generated during research should never be
committed to source control.

---

# Webshell Stage

The PoC contains a webshell stage intended for controlled research.

The webshell is packaged as a WordPress plugin ZIP and deployed through
an authenticated WordPress administrator session established by the
chain.

The research implementation uses a secret token to gate shell requests.

> [!CAUTION]
> The webshell is an exploitation artifact.
>
> Use it only in an isolated laboratory or during an explicitly
> authorized penetration test, and remove it immediately after testing.

---

# Verification

Successful vulnerability validation can be based on evidence such as:

```text
插件版本
       +
可达事件
       +
评论投递
       +
审核哈希渲染
       +
易受攻击的小部件处理
       +
受控执行证据```

For responsible disclosure, collect only the minimum evidence required.

---

# Impact

Successful exploitation may allow an unauthenticated attacker to:

* Execute arbitrary PHP code
* Execute commands in the context of the web server
* Read sensitive application information
* Access environment information
* Modify WordPress files
* Create administrator accounts
* Install malicious plugins
* Establish persistence
* Potentially compromise the underlying server

The ultimate impact depends on the privileges of the PHP process and
the hosting environment.

---

# Detection

Defenders should monitor for unusual activity involving:

* Event comment submissions
* Pending comments followed by moderation-hash access
* Suspicious block markup
* Legacy widget blocks
* Unexpected widget instance data
* Unexpected serialized PHP objects
* PHP execution triggered during event rendering
* Unexpected plugin installations
* New administrator accounts
* Unexpected PHP files
* Suspicious files under `wp-content/uploads/`

A compromise investigation should correlate:

```text
Web 服务器日志
       +
WordPress 日志
       +
数据库活动
       +
文件完整性
       +
管理员账户```

---

# Indicators of Compromise

Potential indicators include:

```text
意外的管理员账户
意外的插件目录
意外的 PHP 文件
wp-content/uploads/ 中的可疑文件
意外的事件评论
异常的审核哈希请求
意外的与 widget 相关的请求
意外的 PHP 执行```

Because individual indicators can have legitimate explanations, they
should be investigated in context.

---

# Mitigation

The primary mitigation is to update **The Events Calendar** to a fixed
version provided by the vendor.

Until the plugin is updated, defenders should consider:

* Disabling comments where operationally acceptable
* Restricting public event comments
* Monitoring event comment traffic
* Reviewing recently created administrator accounts
* Monitoring plugin installation activity
* Performing file-integrity checks
* Reviewing web-server logs
* Reviewing WordPress logs

If compromise is suspected, treat the system as potentially compromised
rather than merely vulnerable.

---

# Incident Response

If exploitation is suspected:

1. Preserve relevant logs.
2. Identify suspicious requests.
3. Review administrator accounts.
4. Review installed plugins.
5. Inspect recently modified PHP files.
6. Inspect `wp-content/uploads/`.
7. Rotate WordPress credentials.
8. Rotate hosting/server credentials where appropriate.
9. Remove unauthorized persistence.
10. Restore trusted application files when necessary.
11. Upgrade the vulnerable plugin.
12. Continue monitoring for re-entry.

---

# Responsible Disclosure

When reporting this vulnerability or derivative research:

* Clearly identify the affected plugin.
* Include the affected version.
* Include the fixed version when confirmed.
* Explain the unauthenticated attack path.
* Document the required prerequisites.
* Provide reproducible evidence in a controlled environment.
* Avoid publishing victim data.
* Never publish generated administrator credentials.
* Never publish live webshell URLs.

---

# Research Limitations

A vulnerable plugin version alone does not guarantee successful
exploitation.

The attack path can be affected by:

* WordPress configuration
* Comment settings
* Event visibility
* Template configuration
* Security plugins
* Web Application Firewalls
* Reverse proxies
* PHP configuration
* Hosting permissions
* Object caching
* Network filtering

Therefore, version fingerprinting should be treated as an initial
indicator rather than definitive proof of exploitability.

---

# Repository Safety

Do not commit:

```text
shells.txt
admins.txt
真实目标 URL
生成的凭据
webshell 文件
捕获的 phpinfo 输出
数据库转储
服务器环境信息
私有测试数据```

Use synthetic laboratory targets when creating screenshots,
demonstrations, or documentation.

---

# Recommended Repository Structure

```text
the-events-calendar-poc/
│
├── poc.py
├── README.md
├── LICENSE
├── .gitignore
│
├── screenshots/
│   └── .gitkeep
│
└── docs/
    └── research-notes.md```

Keep runtime artifacts outside the repository.

---

# Technical Summary

```text
The Events Calendar
        |
        v
V2 Single Event Template
        |
        v
WordPress do_blocks()
        |
        v
Legacy Widget Block
        |
        v
Forged Widget Instance
        |
        v
Valid Integrity Attribute
        |
        v
is_safe_widget_instance()
        |
        v
PHP Object Deserialization
        |
        v
Magic Method Invocation
        |
        v
PHP Object Injection
        |
        v
Remote Code Execution```

---

# Severity

**Impact:** Remote Code Execution

**Authentication:** Not required

**Attack Vector:** Remote

**Primary Component:** The Events Calendar

**Primary Vulnerable Functions:**

```text
is_safe_widget_instance()
enable_rendering_widget_copied()```

**Delivery Mechanism:**

```text
事件评论
+
WordPress moderation-hash URL
+
V2 事件渲染```

---

# Key Takeaway

The important aspect of this vulnerability is not simply that the plugin
uses PHP serialization.

The complete unauthenticated attack path is enabled by the combination
of:

```text
组件验证不足
          +
PHP 魔术方法行为
          +
伪造的完整性属性
          +
do_blocks()
          +
公开事件评论
          +
审核哈希访问```

This combination creates an unauthenticated path to PHP Object Injection
and Remote Code Execution.

---

# Credits

Vulnerability details and affected-version information:

**Wordfence Threat Intelligence**

Research PoC:

**The Events Calendar PHP Object Injection / RCE research implementation**

---

# References

* Wordfence Threat Intelligence — The Events Calendar PHP Object
  Injection / RCE vulnerability
* The Events Calendar
* WordPress Core
* WordPress Comments
* WordPress Block Editor
* WordPress `do_blocks()`
* PHP Object Serialization / Deserialization

---

# Disclaimer

This repository contains security research concerning a remote-code-
execution vulnerability affecting a WordPress plugin.

The PoC is provided for:

* Security research
* Defensive validation
* Authorized penetration testing
* Controlled laboratory reproduction
* Education

Only test systems that you own or have explicit written authorization
to assess.

The authors are not responsible for unauthorized use of this research.

---

# Keywords

```text
CVE-2026-78006
The Events Calendar
The Events Calendar WordPress
The Events Calendar 漏洞
The Events Calendar RCE
The Events Calendar PHP 对象注入
WordPress
CVE-2026-78006 POC
WordPress 安全
WordPress 漏洞
WordPress RCE
PHP 对象注入
PHP 反序列化
未认证 RCE
远程代码执行
CVE
WordPress 插件安全
WordPress 插件 RCE
is_safe_widget_instance
enable_rendering_widget_copied
do_blocks
WordPress 评论
审核哈希
legacy-widget
安全研究
PoC
概念验证
渗透测试```