CVE-2026-78006

The Events Calendar WordPress plugin (versions ≤ 6.17.4 ) is vulnerable to unauthenticated Remote Code Execution via PHP Object Injection in the is_safe_widget_instance function. The root cause is a bypass of the unsafe-object guard: PHP magic methods fire during pre-parse, and enable_rendering_w...