CVE-2026-78006: Unauthenticated Code Execution in WordPress The Events Calendar Plugin — Detection and Remediation Guide

---
title: WordPress Web Server Process Spawning Shell or Command Interpreter
id: 3c7a2e91-4b5d-4f8e-9a1c-6d8e2f5b7c04
status: experimental
description: Detects PHP/Apache/Nginx worker processes spawning command interpreters, a strong post-exploitation indicator for CVE-2026-78006 unauthenticated RCE in The Events Calendar plugin.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78006
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate plugin update or backup scripts invoked by wp-cron (rare; verify script path)
level: high
---
title: PHP File Written to WordPress Uploads Directory
id: 8f1d4c26-7a9b-4e3d-b2f5-1c6a9d3e8b72
status: experimental
description: Detects creation of PHP files in wp-content/uploads, a classic webshell staging location following WordPress plugin RCE such as CVE-2026-78006.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78006
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: '/wp-content/uploads/'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
      - '.phar'
  condition: selection
falsepositives:
  - Rare; some media management plugins write PHP index files - whitelist known plugin paths
level: critical
---
title: HTTP Request Containing PHP Serialized Object Payload to WordPress
id: 5b2e8d41-9c3f-4a7e-8d6b-2e4f7a1c9d35
status: experimental
description: Detects web requests containing PHP serialized object signatures (O:length:) targeting WordPress widget endpoints, consistent with exploitation of unsafe deserialization flaws such as CVE-2026-78006 in The Events Calendar.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78006
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/wp-json/tribe/'
      - 'widget'
      - 'render'
  selection_payload:
    cs-body|contains:
      - 'O:+8:"'
      - 'O:8:"'
      - 'O:%'
      - '__wakeup'
      - '__destruct'
  condition: all of selection_*
falsepositives:
  - Some legitimate plugin state sync operations use serialized data; baseline normal widget admin traffic and tune
level: high

// Hunt 1: Exploitation attempts - PHP serialized object payloads against The Events Calendar endpoints
union isfuzzy=true
(CommonSecurityLog
 | where DeviceVendor =~ "Apache" or DeviceVendor =~ "Nginx" or DeviceProduct has "web"
 | where RequestURL has_any ("/wp-json/tribe/", "widget", "render")
 | where AdditionalExtensions has_any ("O:8:\"", "__wakeup", "__destruct") or RequestURL has_any ("O:8:%22", "O%3A8%3A%22")
 | project TimeGenerated, SourceIP, RequestURL, RequestMethod, AdditionalExtensions, DeviceVendor),
(Syslog
 | where SyslogMessage has_any ("/wp-json/tribe/", "tribe_events")
 | where SyslogMessage has_any ("O:8:\"", "O%3A8%3A", "__wakeup", "__destruct")
 | project TimeGenerated, HostIP, Computer, SyslogMessage)
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, HostIP, Computer
| order by AttemptCount desc;

// Hunt 2: Post-exploitation - web server worker processes executing command interpreters
Syslog
| where Facility =~ "auth" or SyslogMessage has_any ("php-fpm", "www-data", "apache", "nginx")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "nc -", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc;

-- CVE-2026-78006 post-exploitation hunt:
-- 1) Recently written PHP files in wp-content uploads/themes (webshell staging)
-- 2) Processes spawned by the web server user (shells, downloaders)

SELECT FullPath, Size, Mtime, Atime, Mode
FROM glob(globs=[
  '/var/www/**/wp-content/uploads/**/*.php',
  '/var/www/**/wp-content/uploads/**/*.phtml',
  '/var/www/**/wp-content/themes/**/*.php'
])
WHERE Mtime > (now() - 604800)  -- files modified in last 7 days
   AND FullPath !~ 'index\.php$'
ORDER BY Mtime DESC

-- Correlate with processes running as the web server user
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Username =~ 'www-data|apache|nginx|nobody'
  AND (CommandLine =~ '(sh|bash|curl|wget|nc |python|perl|base64)'
       OR Exe =~ '/(sh|bash|dash|python|perl|curl|wget|nc)$')

#!/bin/bash
# CVE-2026-78006 - The Events Calendar plugin verification & remediation helper
# Run as root or with sudo on the WordPress host

WP_PATHS="/var/www /srv/www /home"
echo "=== [1] Locate The Events Calendar plugin and report version ==="
for base in $WP_PATHS; do
  find "$base" -type d -name "the-events-calendar" -path "*wp-content/plugins*" 2>/dev/null | while read -r plugdir; do
    ver=$(grep -m1 "Version:" "$plugdir/the-events-calendar.php" 2>/dev/null | grep -oE "[0-9]+\.[0-9]+\.[0-9]+")
    echo "FOUND: $plugdir  VERSION: $ver"
    if [ -n "$ver" ]; then
      major=$(echo "$ver" | cut -d. -f1); minor=$(echo "$ver" | cut -d. -f2); patchv=$(echo "$ver" | cut -d. -f3)
      if [ "$major" -lt 6 ] || { [ "$major" -eq 6 ] && [ "$minor" -lt 17 ]; } || { [ "$major" -eq 6 ] && [ "$minor" -eq 17 ] && [ "$patchv" -le 4 ]; }; then
        echo "  [!] VULNERABLE to CVE-2026-78006 - update immediately"
      else
        echo "  [OK] Version appears patched"
      fi
    fi
  done
done

echo "=== [2] Attempt update via WP-CLI (preferred) ==="
for base in $WP_PATHS; do
  find "$base" -maxdepth 4 -name "wp-config.php" 2>/dev/null | while read -r cfg; do
    wpdir=$(dirname "$cfg")
    echo "Updating via WP-CLI in $wpdir"
    sudo -u www-data wp plugin update the-events-calendar --path="$wpdir" 2>/dev/null \
      || echo "  WP-CLI update failed or not installed - update manually via wp-admin or vendor zip"
  done
done

echo "=== [3] Hunt for PHP files in uploads (webshell staging) ==="
for base in $WP_PATHS; do
  find "$base" -path "*wp-content/uploads*" -name "*.php*" -mtime -30 2>/dev/null
done

echo "=== [4] Grep access logs for serialized object payloads against widget endpoints ==="
for log in /var/log/apache2/access.log /var/log/nginx/access.log /var/log/httpd/access_log; do
  [ -f "$log" ] && grep -Ei 'O(:|%3A)([0-9]+|%)8(%3A|:)%22|__wakeup|__destruct|/wp-json/tribe/' "$log" | tail -50
done

echo "=== [5] Check for rogue admin users created in last 30 days (via WP-CLI) ==="
for base in $WP_PATHS; do
  find "$base" -maxdepth 4 -name "wp-config.php" 2>/dev/null | while read -r cfg; do
    wpdir=$(dirname "$cfg")
    sudo -u www-data wp user list --role=administrator --field=user_login --path="$wpdir" 2>/dev/null | while read -r adm; do
      reg=$(sudo -u www-data wp user get "$adm" --field=user_registered --path="$wpdir" 2>/dev/null)
      echo "ADMIN: $adm registered: $reg"
    done
  done
done
echo "=== Done. Review all flagged output before declaring the host clean. ==="