How a Comment Reaches the Callable-Injection Sink
The attack begins when an unauthenticated visitor seeds an event with a crafted legacy-widget comment. During single-event rendering, `do_blocks()` processes the comment area and the plugin decodes the block's serialized widget instance. The validator rejects objects but accepts a plain array—and even accepts a failed `unserialize()` result—then recomputes `wp_hash()` over the attacker-controlled data. WordPress consequently accepts the copied widget. Its setup path merges the supplied `classes` map into widget arguments. `Element_Classes::parse_array()` treats each callable value as executable and invokes it, giving the attacker code execution in the WordPress PHP process. Without the required event-comment configuration and planted block, this chain is not reachable.
BitFire FREE Blocks Automated Comment Delivery
BitFire FREE Bot Protection acts at the first boundary: the attempt to submit the crafted comment. Known scanners and attack tools are blocked, while unknown or restricted bots cannot submit forms or POST data. Clients presenting as browsers must pass lightweight JavaScript verification before performing that restricted action, stopping scripts and fake browsers before WordPress stores the malicious block. A trusted bot may be narrowly allowlisted, and a real or successfully verified browser is not claimed to be blocked. For eligible non-commercial sites, this request-layer protection requires no PRO subscription; commercial sites require the appropriate license. This exploit uses a serialized plain array rather than a malicious serialized PHP object, so the protection does not rely on BitFire's WAF object-deserialization rule.
BitFire PRO RASP Denies Persistent Compromise
If the crafted block reaches PHP and its callable executes, BitFire PRO RASP enforces authorization at the dangerous operation. Filesystem protection blocks an unauthenticated request from creating or modifying PHP, preventing the code path from planting a web shell, backdoor, or plugin payload. Database protection rejects unauthorized WordPress user creation and administrator-role assignment, stopping the documented administrator-persistence outcome. These controls do not sanitize the widget instance or claim to suppress every callable; they deny the privileged changes that convert transient execution into durable control. Because RASP evaluates the runtime operation rather than the CVE identifier, the protection does not depend on a vulnerability-specific virtual patch.
If Your Site Was Affected, Investigate for Persistence.
Upgrade immediately to The Events Calendar 6.17.3.1 or later. The patch requires copied instances to decode to arrays and removes the sink by invoking only actual `Closure` objects; serialized function names and array callables become inert data. As an interim measure, disable comments on `tribe_events` posts. Patching closes the known path but does not remove an earlier compromise. Run BitFire Threat Hunter to uncover backdoor WordPress administrator accounts, hidden database triggers, long-running PHP processes, and droppers that restore malware or reinfect the site. Remove every persistence mechanism, preserve and review relevant logs, and rotate affected credentials. An absence of obvious malicious files is not proof that the site is clean.
Deploy Layered BitFire Protection Now
CVE-2026-78159 turns one crafted event comment into critical server-side execution. Deploy BitFire FREE to block automated exploit delivery before WordPress runs, and add BitFire PRO RASP to prevent unauthorized PHP files and administrator persistence at runtime. Then update the plugin and use Threat Hunter to investigate every site that ran an affected release. BitFire provides decisive protection before exploitation, at the privileged operation, and during post-compromise response—without treating security controls as a substitute for patching.
