CVE-2026-11616

Name of the Vulnerable Software and Affected Versions The Events Calendar for GeoDirectory plugin for WordPress versions prior to 2.3.29

Description Authenticated attackers with Subscriber-level access or higher can elevate their privileges to Administrator. This occurs because the ajax ayi action() handler fails to use an allow-list when processing the type and postid variables from the $ POST array, applying only strip tags(esc sql()) before passing them to the update ayi data() function. This function subsequently calls update user meta(), allowing an attacker to write ['subscriber'=>true,'administrator'=>'administrator'] into their own wp capabilities user meta by setting type to wp capabilities and postid to administrator. Consequently, WP User::get role caps() recognizes the administrator key as an active role during the next request.

Recommendations Update the plugin to a version later than 2.3.28.