WORDFENCE ARGUS IDENTIFIES TWO CRITICAL UNAUTHENTICATED VULNERABILITY CHAINS LEADING TO REMOTE CODE EXECUTION IN THE EVENTS CALENDAR PLUGIN

Summary from the TLDR InfoSec newsletter

Two CVSS 9.8 flaws affect The Events Calendar up to version 6.17.4. Anonymous attackers can submit crafted Gutenberg markup in event comments and then trigger execution via pending-comment previews. One chain executes OS commands via PHP object injection, while the other resets an administrator password using wp_update_user. Update to 6.17.4.1. Exploitation requires comments enabled on event pages.