CVE-2026-78006 is a critical remote code execution issue in The Events Calendar for WordPress. It affects all versions up to and including 6.17.4. CVSS 9.8. No login required when comments are enabled and visible on events.
That is the kind of advisory that lands on a Monday and suddenly you need a straight answer: which of our sites run this plugin, and which build are they on?
What the advisory says
Unauthenticated attackers can reach an unsafe unserialize path through crafted block markup in event comments. The practical conditions are clear:
- The Events Calendar is installed at 6.17.4 or older
- Comments are enabled and visible on events
Until a patched release is installed, turning off event comments is a sensible temporary control if you do not need them.
I am not going to invent a fixed version number here. Check the vendor changelog and Wordfence advisory when you update, and confirm the build on each site after the update finishes.
The real problem on a fleet
One site is easy. You open Plugins, you look at The Events Calendar, you update or disable comments.
Twenty sites is where people start guessing from screenshots and half-finished spreadsheets. That is how a vulnerable build stays live for a week after everyone thought they were done.
What you actually need, site by site:
- Is The Events Calendar installed?
- What version is running right now?
- Did the update succeed, and when?
- Any odd admin accounts or file changes after the patch window?
Where CMS Inspect fits
CMS Inspect is our website operations platform for WordPress and Joomla fleets. Free core. $1 per active site per month.
It is built for the boring, necessary work around updates and security triage:
- Uptime monitoring so you notice when something falls over after a rush of patches
- Safer updates with an audit trail across the fleet
- Drive / Dropbox database backups before you roll changes
- Security triage and client-facing reports when you manage sites for other people
When a CVE like this lands, the value is not a clever headline. It is knowing which sites still need attention without opening twenty admin tabs.
Practical checklist for this CVE
- Inventory every WordPress site that uses The Events Calendar.
- Record the installed version before you touch anything.
- Update as soon as a patched release is available, or disable event comments if you cannot update yet.
- Re-check versions after the update window.
- Keep an eye on new admin users and unexpected file changes for a few days.
If you only manage one site, do the update and move on. If you manage a fleet, treat “which sites still run 6.17.4 or older” as the first question, not the last.
CMS Inspect: https://cmsinspect.com
