A critical remote code execution vulnerability in the StellarWP The Events Calendar plugin allows unauthenticated attackers to compromise the entire server.

The flaw stems from insecure deserialization of untrusted data (CWE-502) within the is_safe_widget_instance function. Unauthenticated attackers can trigger this by injecting malicious block markup into event comments, which is then processed by the plugin without sufficient integrity checks.

Successful exploitation grants an attacker the ability to execute arbitrary code on the underlying web server, leading to a complete system compromise. Given the critical 9.8 CVSS score, this vulnerability poses a severe threat of data exfiltration, unauthorized access to sensitive databases, and total loss of service availability.

Immediate Action: Update the StellarWP The Events Calendar plugin to version 6.17.4.1 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review web server access logs for unusual POST requests targeting comment submission endpoints and monitor for unexpected spawned processes or unauthorized file modifications.

Compensating Controls: If an immediate update is not feasible, disable the comments feature for all events to remove the primary attack vector until the patch is deployed.

Public Exploit Available: No

This vulnerability represents a critical risk that requires immediate remediation. Because it allows for unauthenticated remote code execution, organizations should prioritize updating the plugin across all environments without delay to prevent potential exploitation.