The Events Calendar: Unauthenticated PHP object injection
The supplied vector requires neither attacker authentication nor victim interaction. Untrusted data reaches deserialization and can instantiate attacker-controlled PHP objects. The vector reports high confidentiality, integrity and availability impact. The export does not name the request endpoint, parameter, deserializing function, available object classes or gadget chain. A particular code-execution or file-operation chain is therefore not established by this snapshot. Affected versions: n/a through 6.17.4. The authoritative export identifies 6.17.4.1 as fixed for this CVE.
- Component
- The Events Calendar
- Plugin slug
the-events-calendar- Affected
- n/a through 6.17.4
- Safe version
6.17.4.1- Published
- Oct 07, 2026
This CVE was published Oct 07, 2026 and is one of 35 known issues for this plugin.
Update, patch or deactivate.
Update to 6.17.4.1 or a later supported release. Application-level remediation: Avoid deserializing attacker-controlled PHP objects. Prefer a non-object data format with schema validation; where deserialization cannot be removed, explicitly disallow object classes and verify the data source before decoding it.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects The Events Calendar: from n/a through 6.17.4.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H