DEV Community

Anoymask
Anoymask

Posted on

The Events Calendar: Two Unauthenticated RCE Chains via Unapproved Comments

#security #threatintel

1. Basic Information

2. Executive Summary

Because The Events Calendar processes unapproved comments as Gutenberg blocks, an attacker's own preview action leads to dangerous PHP processing. There are two independent paths: one leads directly to OS command execution, and the other public PoC proceeds to RCE through administrator account takeover.

3. Attack Flow

Flow 1: CVE-2026-78006: From PHP Object Injection to RCE

  1. An anonymous attacker posts a comment containing a crafted wp:legacy-widget block to an event page.
  2. The attacker previews their unapproved comment using a URL with a moderation-hash, triggering the do_blocks() process for the entire HTML, including the comment section.
  3. The preliminary unserialize() call returns false because of malformed trailing data. Because contains_object(false) determines that no object exists, is_safe_widget_instance() returns true and allows the data to pass.
  4. The plugin generates a valid wp_hash() for the attacker-specified data and passes it to the subsequent deserialization process.
  5. In the subsequent stage, object restoration starts before failing on the malformed trailing data, invoking an array_map() callback through existing code and executing OS commands with web server privileges.

Flow 2: CVE-2026-78159: From PHP Function Call to Administrator Takeover and RCE

  1. Through the unapproved comment preview, a standard PHP array containing no objects is passed as widget data.
  2. It passes the object check, and the plugin generates a valid hash. The template's extract() call creates a local classes variable from attacker-controlled data.
  3. parse_array(), receiving values from tec_classes(), calls functions that pass the is_callable() check. is_callable() itself does not execute the function.
  4. The public PoC calls wp_update_user() to change the administrator password.
  5. The attacker logs in as an administrator, installs a malicious plugin, and proceeds to RCE. Prior credentials or administrator comment approval are not required.

4. Attacker Position and Execution Location

  • Located where anonymous comments can be posted to public event pages from the internet.
  • Administrator privileges and comment approval are not required at the entry point of the attack, but the comment function and display must be enabled on the target event. In the second chain's public PoC, the attacker logs in as an administrator after changing the password.

5. Visibility for Victims and Administrators

Victim

  • Appears as a normal comment submission and unapproved preview, but server-side code may run immediately upon display.

Administrator

  • Inference: Crafted comments and preview requests with unapproved and moderation-hash serve as clues. For the first path, shell execution from PHP should be checked; for the second path, administrator password changes, suspicious logins, and plugin installations are targets for verification.

6. Success and Failure Conditions

Success Conditions

  • Using vulnerable versions: 6.17.4 or earlier for CVE-2026-78006, and 6.17.3 or earlier for CVE-2026-78159.
  • Event post comments must be enabled and displayed.
  • The attacker must be able to open the URL to preview their own unapproved comment.
  • For the second chain's public PoC to ultimately reach RCE, the attacker must be able to log in as an administrator using the changed credentials and install a malicious plugin.

Failure Conditions

  • Updating to version 6.17.4.1 or later to fix both vulnerabilities.
  • Disabling event comment submission and display removes the prerequisites for the disclosed comment-based attack paths. Also ensure that existing unapproved comments are not processed.
  • Inference: Blocking crafted comments using a WAF may hinder attempts, but this depends on detectable patterns. Restricting OS command execution alone does not necessarily prevent administrator password changes performed within PHP.

7. Impact Upon Success

  • Arbitrary OS commands may be executed with web server privileges, potentially leading to a complete takeover of WordPress.
  • May lead to sensitive data theft, malware or webshell installation, defacement, or service disruption.
  • Public articles have not confirmed actual damage; impact is evaluated based on vulnerabilities and PoC.

8. Observable Logs

Email

  • Email is not required for this attack.
  • Inference: Review any WordPress notification emails or administrator change notifications that may help establish post-compromise activity.

Proxy / SWG / DNS

  • Inference: Check for POST requests submitting comments to event pages, followed immediately by GET requests containing unapproved and moderation-hash.

Endpoint / EDR

  • Inference: Check for child processes such as sh, bash, or cmd spawned from PHP-FPM/Apache, as well as new or modified PHP files in the web root.

Identity / IdP

  • Inference: Check for the addition of WordPress administrators, password/email changes, and anomalies in existing sessions.

SaaS / Cloud

  • Inference: Check hosting management interfaces, CDNs, WAFs, and backup audit logs for changes made after the compromise timestamp.

Network

  • Inference: Check for new outbound traffic from the web server, payload retrieval, and C2 connections.

9. Attack Success Determination

Confirmed in Public Information

  • Initial Execution Confirmed: Public Info: Wordfence verified two independent paths in a research environment. The first path executes OS commands, and the second public PoC leads to RCE through administrator takeover followed by malicious plugin installation. This is not a report of actual damage.

Internal Determination Criteria

  • Attack Attempt Observed (Success Unconfirmed): Criteria: Crafted comments and preview requests alone do not indicate successful RCE. Verify target versions, comment settings, and processing results.
  • Initial Execution Confirmed: Criteria: For the first path, verify execution logs or command output from the web server. For the second path, corroborate password changes, administrator logins, and plugin installation/execution in sequence.
  • Subsequent Compromise Confirmed: Criteria: Webshell execution, data exfiltration, defacement, and external communication must be determined individually based on actual evidence. Do not confuse potential impact with confirmed damage.

10. Investigation Playbook

Trigger

  • Inference: Initiate investigation upon discovering vulnerable versions and enabled comment settings, suspicious unapproved comments, or administrator password changes.

Initial Verification

  • Inference: Check vulnerable versions for both CVEs, event comment posting/display settings, and whether previews are accessible.

Endpoint / Server

  • Inference: Preserve comment bodies, post/preview requests, PHP/web server logs, and modified files to investigate code execution in the first path.

Authentication / Cloud

  • Inference: For the second path, collate administrator password changes, immediate logins, and plugin uploads/activation.

Subsequent Actions

  • Inference: Trace data access, outbound transmission, webshells, and defacement using additional evidence, avoiding treating the mere possibility of RCE as actual damage.

Containment

  • Inference: Restrict comment submission and preview paths after preserving evidence, and update to version 6.17.4.1 or later. If compromised, remediate administrator credentials and unauthorized plugins/files.

Decision Categories

  • Inference: Distinguish between comment submission/preview, dangerous PHP function calls, administrator takeover, RCE, and subsequent compromise.

11. Defense and Detection Ideas

Single Event

  • Inference: Target suspicious wp:legacy-widget blocks within unapproved comments and preview requests for those comments. Since previewing after comment submission is normal behavior, do not determine maliciousness based on this alone.

Timeline Correlation

  • Inference: Correlate whether OS command execution occurred, or whether it progressed to administrator password changes, logins, and plugin installation following crafted comments and previews, categorized by path.

Threat Hunting

  • Inference: Inventory sites running vulnerable versions with event comments enabled, and search for unapproved comments and server execution history.

Log Gaps

  • Inference: If comment bodies or WAF logs are not retained, incoming payloads may not be recoverable.

Priority Countermeasures

  • Update to version 6.17.4.1 or later and disable unnecessary event comments.
  • Inference: Implement web server execution/write restrictions and maintain backups for recovery as auxiliary measures.

12. Facts / Inference / Hypothesis

Facts

  • The Events Calendar V2 single-event templates pass the entire page, including comments, to do_blocks(), causing Gutenberg blocks within anonymous comments to be processed.
  • Because WordPress returns preview URLs with a moderation-hash to authors of unapproved comments, attackers can trigger vulnerable processing by viewing the page before administrator approval.
  • The plugin generates a valid wp_hash() for attacker-controlled widget data, allowing that data to pass WordPress core's hash verification.
  • In CVE-2026-78006, preliminary deserialization returns false because of malformed trailing data, causing the safety check to return true. During subsequent object restoration, a callback chain in existing code is invoked, leading to OS command execution.
  • In CVE-2026-78159, arbitrary PHP functions can be called from normal arrays. The public PoC leads to RCE through administrator password changes, administrator logins, and malicious plugin installation.
  • CVE-2026-78006 affects versions 6.17.4 and earlier and is fixed in 6.17.4.1. CVE-2026-78159 affects versions 6.17.3 and earlier and is fixed in 6.17.3.1. Updating to version 6.17.4.1 or later is recommended to address both.
  • Wordfence verified the PoC in a research environment. This requires comments to be enabled and displayed, and the cited sources do not report exploitation in the wild.

Inference

  • Even if known attacks are blocked by a WAF, as long as unpatched plugins process comments as blocks, attacks using alternative expressions may be missed. Prioritize updates and verification of comment settings.

Hypothesis

No additional hypotheses. Unverified items are noted under "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: high): Attacks public WordPress sites using anonymous comments and unapproved comment previews.
  • T1059.004 Command and Scripting Interpreter: Unix Shell (Confidence: medium): The PoC executes OS commands on the web server via a system callback.

14. Unknowns and Additional Investigation

  • Presence of active exploitation in the wild.
  • Number of live sites running vulnerable versions with event comments enabled.
  • WAF evasion payloads and specific post-compromise activities.

15. Impact on SOCs and Organizations

Organizations using The Events Calendar on WordPress should inventory both plugin versions and comment settings for tribe_events. Investigate unapproved comment previews alongside PHP function calls, OS command execution, administrator password changes, and subsequent plugin activity, according to the attack path.

16. Summary by Role

  • SOC: Investigate whether crafted unapproved comments and preview requests led to OS command execution, or progressed to administrator password changes, logins, and plugin execution.
  • Administrators: Update The Events Calendar to version 6.17.4.1 or later and disable unnecessary event comments.
  • Users: No action is required for general users. Request site administrators to verify update statuses.

Top comments (0)