A critical remote code execution vulnerability in the StellarWP The Events Calendar plugin allows unauthenticated attackers to compromise the underlying server.

The vulnerability exists within the Element_Classes::parse_array function, where insufficient validation of the widget classes map allows a crafted payload to bypass object checks. This enables an unauthenticated attacker to reach a callable-invocation sink and execute arbitrary code on the server when processing specific comment blocks.

Successful exploitation of this flaw grants an attacker full control over the web server, leading to potential data exfiltration, system-wide compromise, and total loss of confidentiality, integrity, and availability. With a CVSS score of 9.8, this vulnerability represents an extreme risk to the business, particularly for organizations hosting sensitive event data or integrated services.

Immediate Action: Update the The Events Calendar plugin to version 6.17.3.1 or later immediately to apply the necessary validation logic.

Proactive Monitoring: Review web server access logs for anomalous requests containing wp:legacy-widget blocks or unusual patterns targeting tribe_events posts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious serialized objects or suspicious input targeting WordPress widget parameters.

Public Exploit Available: No

Given the critical severity of this remote code execution vulnerability, administrators must prioritize patching the affected plugin immediately. Failure to update allows for trivial unauthenticated access, which poses an unacceptable risk to the environment. Ensure all instances of The Events Calendar are verified to be running the corrected version.