The Events Calendar Unauthenticated PHP Object Injection

A CVSS 9.8 PHP object injection flaw in The Events Calendar WordPress plugin leads this digest, alongside a MasterStudy LMS file deletion vulnerability.

2026-08-25 01:01 UTC

🔓 CVEs & KEV

CVE-2026-78265 — CVSS 9.8 — The Events Calendar Unauthenticated PHP Object Injection
CVE-2026-78284 — CVSS 8.6 — MasterStudy LMS Unauthenticated Arbitrary File Deletion (CVE-2026-78284)

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check