Filtered by tag: the events calendar × Clear
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Matched: WordPress
Critical unauthenticated remote code execution vulnerabilities have been discovered in The Events Calendar WordPress plugin, which has over 200,000 active installations. The flaws could allow attackers to fully take over affected sites without needing valid credentials. Site owners are urged to update the plugin immediately to a patched version to mitigate the risk.
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Matched: WordPress
Wordfence discovered two critical unauthenticated remote code execution vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites. Both chains exploit the plugin's widget-rendering pipeline, triggered via pending comment previews without moderator approval, requiring only that comments be enabled on event pages. The first uses PHP Object Injection; the second abuses an arbitrary PHP callable to reset an admin password. Users should update to version 6.17.4.1 immediately.