A critical PHP object injection vulnerability in Nexcess The Events Calendar allows unauthenticated attackers to achieve remote code execution.

This vulnerability is a deserialization of untrusted data (CWE-502) flaw within the plugin, which permits unauthenticated attackers to inject malicious PHP objects into the application.

Successful exploitation of this flaw allows an unauthenticated attacker to execute arbitrary code on the underlying server, leading to a full system compromise. Given the CVSS score of 9.8, this vulnerability poses an extreme risk to data confidentiality, integrity, and availability, potentially resulting in complete site takeover and unauthorized access to sensitive database information.

Immediate Action: Update the WordPress The Events Calendar plugin to version 6.17.3 or the latest available version immediately.

Proactive Monitoring: Review web server access logs for anomalous requests containing serialized PHP strings or unusual POST payloads directed at plugin endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block malicious deserialization attempts and common PHP object injection patterns.

Public Exploit Available: Unknown

The severity of this vulnerability cannot be overstated given its potential for unauthenticated remote code execution. Administrators must prioritize updating the affected plugin to version 6.17.3 or higher to close the deserialization vector and prevent potential compromise.