The Events Calendar WordPress Plugin (versions before 6.17.3.1)
A WordPress plugin with over 600,000 active installations that lets website administrators create and manage event listings on their sites.
Root Cause
The plugin processes user-supplied comment data before validating it properly. Because the injected code reaches the vulnerable function before comment moderation occurs, no login or approval is required to trigger it.
Attack Vector
An attacker visits an event page on your site, submits a crafted comment containing malicious code, and the server executes it — handing over full control of the WordPress installation. No account needed.
Detection Notes
Check server logs for unexpected POST requests to event comment endpoints. Look for unfamiliar admin accounts created recently. Monitor for unusual file modifications in your WordPress directory.
Recommended Actions
- Update The Events Calendar to version 6.17.4.1 or later immediately.
- If you cannot update right away, disable comments on event pages.
- Audit recently created admin accounts and review access logs for anomalous activity.
These recommendations are AI-generated based on available information at time of writing. Always verify with the official vendor advisory or CVE record before acting in a production environment.