{"vulnerability": "CVE-2026-78159", "sightings": [{"uuid": "0191a399-b196-462a-8a64-8c8dd9271d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvcmxdfmwh2p", "content": "CVE-2026-78159 - the events calendar\nThe Events Calendar add\u2011on for WordPress can be tricked into executing any code an attacker supplies, even without logging in. The problem occurs when a crafted comment is\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#stellarwp #CVE #infosec", "creation_timestamp": "2026-09-12T08:10:07.352943Z"}, {"uuid": "8723feab-61e9-4e50-9206-5badd99b02f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78159", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117257248707504649", "content": "CVE-2026-78159: CRITICAL RCE in The Events Calendar (<=6.17.3). Unauthenticated attackers can run arbitrary code via crafted comments. Disable comments on tribe_events posts to mitigate. CVSS 9.8. Details: https://radar.offseq.com/threat/cve-2026-78159-cwe-94-improper-control-of-generation-of-code-code-injection-in-stellarwp-the-events-c0d168b99a9315ff #OffSeq #WordPress #Infosec #RCE", "creation_timestamp": "2026-09-12T09:00:24.840386Z"}, {"uuid": "b4e3817b-5ebf-49b8-b853-e41f58675385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvcprbwjz42v", "content": "\ud83d\udd34 CVE-2026-78159 - Critical (9.8)\n\nThe The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-78159/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-12T09:00:26.341637Z"}, {"uuid": "745ece2a-5dcd-4043-a6bb-16e8a036f727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78159", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvcprcnvek24", "content": "stellarwp The Events Calendar <=6.17.3 hit by CRITICAL RCE (CVE-2026-78159). Unauthenticated code execution via crafted comments. Disable comments on tribe_events posts to reduce risk. Details: https://radar.offseq.com/threat/cve-2026-78159-cwe-94-improper-control-of-generation-of-code-code-injec...", "creation_timestamp": "2026-09-12T09:00:27.242850Z"}, {"uuid": "0253bfad-2275-4fce-ad3d-756bef47ef1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/b4egtall5vex2", "content": "CVE-2026-78159 - The Events Calendar\nCVE ID : CVE-2026-78159\n \n Published : Sept. 12, 2026, 8:16 a.m. | 43\u00a0minutes ago\n \n Description : The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the pars...", "creation_timestamp": "2026-09-12T09:28:02.139565Z"}, {"uuid": "8c1b71d8-6097-4822-8700-5058119932ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvctiqrd4225", "content": "\ud83d\udea8 CVE-2026-78159 \u2014 CVSS 9.8 CRITICAL\n\nThe The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78159\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-12T10:07:14.073013Z"}, {"uuid": "7c18c3bc-1f89-42c6-921a-e63c8720fc77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78159", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117262203324178669", "content": "CVE-2026-78159: The Events Calendar <=6.17.3 for WordPress has a CRITICAL RCE flaw via parse_array(). Unauthenticated code execution if comments on tribe_events posts are enabled. Disable comments as interim mitigation. https://radar.offseq.com/threat/the-the-events-calendar-plugin-for-wordpress-is-vulnerable-to-remote-code-execution-in-all-versions-up-1ecd7d8aa73f934d #OffSeq #WordPress #RCE #CVE202678159", "creation_timestamp": "2026-09-13T06:00:27.059310Z"}, {"uuid": "0c53b091-d8a0-4e3a-807e-17ce63cc7d76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78159", "type": "seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mvi7rhzih72e", "content": "Two unauthenticated RCEs (CVSS 9.8) in The Events Calendar WordPress plugin, all versions through 6.17.4. Disable or update\u2026 https://0daynews.com/articles/2026-09-13-events-calendar-cve-2026-78159-78006-rce/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-2001", "creation_timestamp": "2026-09-14T13:30:10.897557Z"}]}