CDI WU Warns of Critical Vulnerabilities in The Events Calendar Plugin, Urges Website Administrators to Update Immediately
The Center for Digital Innovation (CDI), Walailak University, advises website administrators to check the version of the The Events Calendar plugin installed on their WordPress websites and update to version 6.17.4.1 or later as soon as possible. The recommendation follows a security alert issued by the National Broadcasting and Telecommunications Commission (NBTC), warning WordPress website administrators about two Critical-severity vulnerabilities discovered in the plugin.
On September 17, 2026, the NBTC issued an alert urging WordPress website administrators to check their use of The Events Calendar following the disclosure of two Critical-severity security vulnerabilities: CVE-2026-78159 and CVE-2026-78006, both receiving a CVSS score of 9.8. The vulnerabilities could allow unauthenticated attackers to execute commands on the server, potentially leading to full control of an affected website. The plugin is installed on more than 600,000 websites, while WordPress data indicates that more than 240,000 websites were still running versions older than 6.17. However, the exact number of websites that are actually exploitable remains uncertain, as exploitation requires specific conditions related to the use of comments on Event pages.
The vulnerability CVE-2026-78159 is a Code Injection vulnerability that may allow an attacker to invoke PHP functions to change an administrator’s password before logging in and subsequently upload a malicious plugin, potentially leading to command execution on the server. Meanwhile, CVE-2026-78006 is a PHP Object Injection vulnerability that may allow attackers to execute commands on the server without requiring a user account or waiting for administrator approval of comments. However, the affected website must have comments enabled on Event pages and have the “Show comments on event pages” option enabled in the plugin for the relevant attack conditions to exist.
As Walailak University uses WordPress to develop and manage websites for various university units, CDI strongly urges all website administrators to check the installed version of The Events Calendar and update to version 6.17.4.1 or later as soon as possible. If an immediate update is not possible, administrators should consider temporarily disabling comments on Event pages to reduce potential attack conditions. Website administrators should also regularly monitor their websites for unusual activities and unauthorized changes.
Taking these preventive measures can help strengthen website security, reduce exposure to cyber threats, and protect university websites from potential exploitation.
Thank you for the information ThaiCERT https://www.thaicert.or.th/2026/09/17/%e0%b8%9e%e0%b8%9a%e0%b8%8a%e0%b9%88%e0%b8%ad%e0%b8%87%e0%b9%82%e0%b8%ab%e0%b8%a7%e0%b9%88%e0%b9%83%e0%b8%99%e0%b8%9b%e0%b8%a5%e0%b8%b1%e0%b9%8a%e0%b8%81%e0%b8%ad%e0%b8%b4%e0%b8%99-the-events-calendar/