CVE-2026-39532

Name of the Vulnerable Software and Affected Versions Events Calendar for GeoDirectory versions prior to 2.3.26

Description The Events Calendar for GeoDirectory plugin for WordPress allows authenticated attackers with contributor-level access and above to perform PHP Object Injection. This occurs through the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the software, the presence of a POP chain in another installed plugin or theme could enable the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 2.3.25.