Unpatched WordPress Plugin Leaves Sites Open to Attack
Developers issued two security patches, but 240,000 sites remain exposed to remote code execution vulnerabilities.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you feel responsible for managing security updates on your own website, or the plugin developers?
Developers released security patches for two remote code execution vulnerabilities in the WordPress Events Calendar plugin, finalized on September 10, 2026. Despite these updates, approximately 240,000 active WordPress sites remain exposed to potential exploitation.
Why it matters
The presence of public proof-of-concept code creates a significant security risk for the large segment of the ecosystem that has failed to apply available patches. The vulnerabilities underscore the danger of processing unmoderated user input within privileged code paths.
Version 6.17.3.1 addressed CVE-2026-78159, while 6.17.4.1 resolved CVE-2026-78006. These patches fixed flaws where unmoderated user input bypassed authentication checks.
The details
The vulnerabilities occur because the plugin processes unmoderated input through privileged code before performing authentication. CVE-2026-78159 exploited the is_callable() PHP function—a tool that checks if a value can be called as a function—to trigger unauthorized admin password resets. CVE-2026-78006 allowed attackers to execute malicious serialized PHP payloads—data structures converted into a storable format—via unauthenticated comment preview links.
Timeline
August 26, 2026: CVE-2026-78159 patch released in version 6.17.3.1.
September 10, 2026: CVE-2026-78006 patch released in version 6.17.4.1.
The Tech Race
This vulnerability highlights a recurring pattern of security debt in the WordPress plugin ecosystem where feature deployment often outpaces necessary maintenance. The reliance on public proof-of-concept code accelerates the race between developers issuing patches and attackers weaponizing unpatched instances.
Site administrators must ensure their plugin version is updated to at least 6.17.4.1 to neutralize these threats. If immediate updates are not feasible, disabling comments on all event pages removes the primary attack vector for both identified vulnerabilities.
The takeaway
Site owners should treat the presence of public proof-of-concept code as a signal that active scanning for these vulnerabilities is likely occurring. Organizations should prioritize a full audit of plugin dependencies to verify that all components are running versions released after September 10, 2026.
Further reading
For broader trends in web platform security, visit Cybersecurity.
Source note: This article includes information reported by Cybersecurity Insiders.
Live Poll
Do you feel responsible for managing security updates on your own website, or the plugin developers?
