Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Élevé · Wordfence · 14 septembre 2026

WordPress

Ce qui s'est passé

Wordfence found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, affecting 600,000+ sites via its widget-rendering pipeline.

À faire maintenant

Update The Events Calendar to the latest patched version immediately; verify with vendor advisory. If no patch, disable the plugin or block widget endpoints via WAF. Scan for compromise.

Source originale

Wordfence

Analyse assistée par IA, sources citées. Vérifiez auprès de l'avis du fournisseur avant d'agir.