CVE-2026-11616
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Events Calendar for GeoDirectory plugin for WordPress up to version 2.3.28 has a privilege escalation vulnerability. The ajax_ayi_action() handler does not properly sanitize the 'type' and 'postid' parameters, allowing an authenticated attacker with Subscriber-level access to escalate to Administrator by passing type=wp_capabilities and postid=administrator.
Risk Assessment
An attacker with low privileges can gain full control over the WordPress installation, potentially leading to site takeover and data access.
Recommendation
Update the Events Calendar for GeoDirectory plugin to the latest version that includes the fix.
Other vulnerabilities in Events Calendar for GeoDirectory
Original NVD description (English source)
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.