Unauthenticated RCE Flaws in The Events Calendar Affect 600K+ WordPress Sites

Key points

• Two critical RCE flaws affect The Events Calendar WordPress plugin.
• Attacks can be unauthenticated, with CVSS scores reported at 9.8.
• More than 600,000 WordPress installations may be exposed.
• No CVE IDs were listed in the source report; verify vendor advisory.
• K-12 and government WordPress sites should patch or disable the plugin immediately.

Security reporting indicates that two critical remote code execution vulnerabilities exist in The Events Calendar, a widely used WordPress plugin. The flaws are described as unauthenticated, meaning an attacker would not need valid credentials to attempt exploitation. The reported CVSS score is 9.8, and more than 600,000 WordPress installations may be affected. No CVE identifiers were provided in the source, so administrators should confirm details through the vendor and reputable vulnerability databases.

Any WordPress site running a vulnerable version of the plugin is potentially at risk, including school district websites, school calendars, municipal portals, and other government-facing WordPress properties. Because the plugin is often installed to publish public event calendars, it may be exposed directly to the internet even when other parts of a site are restricted. Sites that have the plugin installed but inactive or forgotten may also remain in scope if the files are still present and reachable.

Remote code execution on WordPress is a severe outcome. An unauthenticated attacker could potentially take full control of a site, deploy web shells, create rogue administrator accounts, alter or exfiltrate data, deface public pages, or use the server as a foothold for deeper network activity. A CVSS score of 9.8 and unauthenticated access lower the skill barrier, increasing the likelihood of automated mass exploitation once technical details circulate.

The Events Calendar is popular precisely because it solves a common publishing need, which is why the reported install count is significant. WordPress plugin flaws remain one of the most common ways sites are compromised, and calendar plugins are attractive targets because they are frequently public-facing. Without CVE IDs, tracking official patch status is harder, so IT teams should not wait for a formal advisory if a vendor update or mitigation is available.

What to watch: vendor communications, WordPress plugin update notifications, WAF alerts, and unusual requests to calendar-related plugin endpoints. Administrators should treat this as an emergency patching event, especially where the plugin is internet-facing. If no fixed version is available, disabling or removing the plugin is the safest immediate step, followed by compromise checks and credential rotation if exploitation is suspected.

What to do now

1. Inventory all WordPress sites for The Events Calendar and record the installed plugin version.
2. Apply the vendor's patched version immediately; if no patch is available, deactivate and remove the plugin until a fix exists.
3. If the plugin is business-critical and cannot be removed, deploy WAF or virtual patching rules to block exploit attempts, but do not rely on them alone.
4. Scan sites for compromise indicators, including unexpected admin users, modified core or plugin files, web shells, suspicious scheduled tasks, and unusual outbound connections.
5. Force password resets for WordPress administrators and rotate database, hosting, API, and authentication salt keys if compromise is suspected.
6. Review web server, WAF, and WordPress audit logs for exploitation attempts and anomalous POST requests to plugin endpoints.
7. Verify isolated backups and test restoration; report suspected incidents to your security team or the appropriate government cybersecurity contact.

Original source

Hackread