TLDR Tech / InfoSec
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Critical unauthenticated vulnerability chains (CVSS 9.8) in The Events Calendar plugin (versions up to 6.17.4) allow remote code execution or admin password reset. Attackers can exploit this by submitting crafted Gutenberg markup in event comments and triggering execution via pending-comment previews. An update to version 6.17.4.1 is required, and exploitation depends on comments being enabled on event pages.
Read the full story