WAF Watch: Events Calendar RCE, Elementor uploads, Drupal table field

Mac Clark · September 14, 2026

A short roundup of what hit websites this past stretch — and what to do about it if you run campus or agency sites. Fear is cheap; checklists are useful. Here’s what operators should actually touch this week.

ProtectMyWebsite is the WAF that tells you what’s safe to block — rules start in count, then your dashboard shows what to promote. You still decide.

1. The Events Calendar — unauthenticated RCE (CVE-2026-78159)

StellarWP’s The Events Calendar through 6.17.3 is an unauthenticated RCE, CVE-2026-78159, CVSS 9.8. A plain-array widget classes payload bypasses is_safe_widget_instance() and reaches the callable sink in Element_Classes::parse_array(). The chain uses a crafted wp:legacy-widget block in tribe_events comments; do_blocks() on the single-event page is what fires it. Patchstack’s advisory, NVD, and vuln.today have the technical detail.

Do this: Patch to 6.17.3.1 or later. If you cannot patch yet, disable comments on tribe_events and sweep existing comments for legacy-widget blocks. Put an edge virtual-patch in count first; promote only after the hits look like the exploit.

2. Elementor Pro — form-upload exploitation (CVE-2026-32475)

On September 5, SecurityWeek reported active exploitation of Elementor Pro CVE-2026-32475. Wordfence has seen 190,000-plus attempts. The fix shipped in 4.2.2 on August 19. Unauthenticated attackers upload PHP under wp-content/uploads/elementor/forms/ when a published form has a file field.

Do this: Get every Elementor Pro install to 4.2.2 or later. Sweep that uploads path for unexpected .php files (IoCs). Review admin-ajax form submissions. Virtual-patch multipart upload abuse in count; promote when the body matches look clean.

3. Drupal Ultimate Table Field — access bypass (CVE-2026-87955)

SA-CONTRIB-2026-153 / CVE-2026-87955: anonymous users can open the Ultimate Table Field cell editor and upload file cells (pdf, doc, docx). Fixed in 1.1.1 and 2.0.1. After you update, grant the new cell-editor permission to roles that actually edit those tables. See the Drupal advisory.

Do this: Update, then grant the new permission. Challenge anonymous POSTs to the cell-editor route at the edge — in count first.

4. UC Berkeley EECS — public web down when research infra is quarantined

The Daily Californian reported that UC Berkeley EECS systems went offline from August 25 after Trellix EDR flagged suspicious activity. Some faculty pages were still down into early September. The lesson: public web goes down when research and instructional infrastructure is quarantined together.

Do this: Separate origin exposure for public web vs research/instructional infra. Name a status and comms owner before the next incident. Rate-limit auth and admin in count. Keep origin IPs off the public internet.

Tip of the week

Comment- and form-shaped RCEs are why count mode exists.

Put body-aware virtual-patch rules in count. After about a day, the dashboard shows what those rules actually hit. Then one click to promote. Confirm the match is the exploit (legacy-widget comments, multipart form uploads, anonymous table-editor POSTs), not junk.

That’s how we run ProtectMyWebsite: rules start in count; after 24 hours the dashboard shows what’s safe to block — one click. Promote Copilot reads your count window and explains what's safe to promote — you still click once. Copilot explains only — no auto-block.

$150/site/mo with a 14-day trial. Refer a friend: 10% off for 3 months for both sides.

Campus Estate is quote on request — talk to sales team. We do not publish Estate list prices.

If you run campus or agency sites: scan your site, see what WAF count mode is, what's safe to block on a WAF, emergency virtual patching when a CMS CVE drops, managed WAF for university and college websites, managed WAF for government and public-sector websites, and start a 14-day trial.