CVE Catalog
CVE-2026-78265
CriticalCVSS 9.8Summary
Unauthenticated PHP Object Injection in The Events Calendar versions up to 6.17.2.
Risk Assessment
An attacker can exploit this to achieve remote code execution or data manipulation, potentially leading to WordPress site takeover.
Recommendation
Update The Events Calendar plugin to the latest patched version. Restrict access to forms and monitor logs for suspicious activity.
Original NVD description (English source)
Unauthenticated PHP Object Injection in The Events Calendar <= 6.17.2 versions.