AIKIDO-2026-972995
the-events-calendar is vulnerable to Code Injection
98
Critical Risk
This Affects:
the-events-calendarTL;DR
is_safe_widget_instance() only accepts object widget instances, so a plain-array classes map slips past that check and reaches Element_Classes::parse_array(), which invokes caller-supplied callables. An unauthenticated commenter can submit a crafted wp:legacy-widget block; when do_blocks() processes the single-event HTML including the comment area, that payload runs as PHP on the server. Successful exploitation leads to remote code execution. The fix validates the widget classes map so array payloads cannot reach the callable-invocation sink.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and comments are enabled on tribe_events posts.
Background info
the-events-calendar is vulnerable to Code Injection in versions 0.0.1 - 6.17.3.
How to fix this
Upgrade the the-events-calendar and/or the The Events Calendar library to the patch version.
Links
wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cveplugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendarplugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.