147 lines
6.3 KiB
JSON
147 lines
6.3 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-78159",
|
|
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Wordfence",
|
|
"dateReserved": "2026-08-23T11:39:39.155Z",
|
|
"datePublished": "2026-09-12T07:39:15.542Z",
|
|
"dateUpdated": "2026-09-14T16:10:33.540Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
|
"shortName": "Wordfence",
|
|
"dateUpdated": "2026-09-12T07:39:15.542Z"
|
|
},
|
|
"affected": [
|
|
{
|
|
"vendor": "stellarwp",
|
|
"product": "The Events Calendar",
|
|
"versions": [
|
|
{
|
|
"version": "0",
|
|
"status": "affected",
|
|
"lessThanOrEqual": "6.17.3",
|
|
"versionType": "semver"
|
|
}
|
|
],
|
|
"defaultStatus": "unaffected"
|
|
}
|
|
],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parse_array function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the is_safe_widget_instance() object check and reach the callable-invocation sink in Element_Classes::parse_array(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the targeted site has comments enabled on tribe_events posts and that at least one comment containing a crafted wp:legacy-widget block has been submitted, as the attack chain is triggered when do_blocks() processes the single-event HTML including the comment area."
|
|
}
|
|
],
|
|
"title": "The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation",
|
|
"references": [
|
|
{
|
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c?source=cve"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/common/src/Tribe/Utils/Element_Classes.php#L211"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/views/v2/components/messages.php#L30"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Widgets/Service_Provider.php#L279"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.17.3/src/Tribe/Views/V2/Template_Bootstrap.php#L214"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3667866%40the-events-calendar&new=3667866%40the-events-calendar"
|
|
},
|
|
{
|
|
"url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3667867%40the-events-calendar&new=3667867%40the-events-calendar"
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')",
|
|
"cweId": "CWE-94",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
}
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"type": "finder",
|
|
"value": "Chloe Chamberland"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"type": "finder",
|
|
"value": "Wordfence Argus"
|
|
}
|
|
],
|
|
"timeline": [
|
|
{
|
|
"time": "2026-08-23T11:54:47.000Z",
|
|
"lang": "en",
|
|
"value": "Vendor Notified"
|
|
},
|
|
{
|
|
"time": "2026-09-11T18:40:37.000Z",
|
|
"lang": "en",
|
|
"value": "Disclosed"
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-09-14T16:10:22.569007Z",
|
|
"id": "CVE-2026-78159",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "yes"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-09-14T16:10:33.540Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |