The Events Calendar WordPress plugin: PHP Object Injection via untrusted data
Summary
The Events Calendar WordPress plugin up to and including version 6.17.4 deserializes untrusted data, which allows PHP Object Injection. Patchstack classifies the issue as unauthenticated and rates it CVSS 9.8 (critical). Successful exploitation can let an attacker manipulate how the site processes data and run harmful actions on the web server; a related record for the same version range describes remote code execution.
Affected
- The Events Calendar (WordPress plugin) from n/a through 6.17.4
- Default configuration: unaffected according to the CNA wording, which lists the affected range only
Fixed in
- Update to 6.17.4.1 or later (minimum known fixed release per Patchstack and secondary reporting)
- Unknown: whether 6.17.4.1 fully resolves CVE-2026-95606 specifically; one secondary source names 6.17.5 or later, which could not be verified
Workaround
- No vendor workaround known; the fix is an update.
- Interim measure (not from the vendor): disable comments on event pages until patching, as a related exploit chain requires comments.
- A web application firewall rule blocking serialized PHP object payloads may serve as a temporary stopgap only.
Exploitation
- VulDB and CISA SSVC list no known exploitation for CVE-2026-95606 itself; CISA SSVC rates it as automatable.
- A related record (CVE-2026-78006) for the same version range is reported as actively exploited in the wild, and a public proof-of-concept exists for it.
- Patchstack describes the flaw as likely to be exploited in mass campaigns.
Our recommendation
- Check the plugin version on all WordPress sites now.
- Update The Events Calendar to 6.17.4.1 or a later release confirmed by the StellarWP changelog.
- Until patched, disable comments on event pages where possible and consider a WAF rule as a stopgap.
- Review web server logs for suspicious POST requests to event and comment endpoints if the plugin was exposed before patching.
- Verify the site is not compromised, for example by checking for unknown files or admin accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB CVE-2026-95606 vuldb.com
- VulDB exploit status vuldb.com
- OpenCVE CVE-2026-95606 app.opencve.io
- Security Online: related CVE-2026-78006 exploitation securityonline.info
- Patchstack plugin vulnerabilities list patchstack.com
- WPScan The Events Calendar wpscan.com
- HOL Guard CVE-2026-78006 advisory hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:37.
Original description (NVD)
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.