CVE-2026-11616: Events Calendar for GeoDirectory Privilege Escalation Vulnerability

Technical summary

CVE-2026-11616 stems from insufficient input validation in the ajax_ayi_action() handler within the Events Calendar for GeoDirectory plugin. The function applies only strip_tags() and esc_sql() without an allowlist to the $_POST['type'] and $_POST['postid'] parameters before passing them to update_ayi_data(). This function subsequently calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts), which writes arbitrary user metadata. By setting type=wp_capabilities and postid=administrator, an attacker crafts a payload that inserts ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities meta key. On the next request, WordPress's WP_User::get_role_caps() function interprets the 'administrator' array key as an active role, effectively promoting the attacker to Administrator-level access. The vulnerability is classified under CWE-269 (Improper Access Control).

Business impact

This vulnerability poses a severe risk to WordPress sites using the Events Calendar for GeoDirectory plugin. An attacker with minimal access—even a standard Subscriber account—can escalate to full administrative control, enabling them to modify site content, install malicious plugins, extract sensitive data, create backdoor accounts, or take the site offline. Organizations running this plugin should treat this as a critical operational security issue, as the barrier to exploitation is low and the impact is complete system compromise.

Affected systems

The Events Calendar for GeoDirectory plugin for WordPress, versions up to and including 2.3.28, is affected. WordPress installations with this plugin installed and active are at risk if any user account exists with Subscriber-level permissions or higher. Multisite WordPress instances amplify the risk, as a single compromised low-privilege account could cascade across multiple sites sharing the same plugin codebase.

Exploitability

This vulnerability is highly exploitable. It requires only network access and valid WordPress credentials at the Subscriber level or above—a low bar for many sites that allow public user registration. No user interaction is needed; the attack occurs via a direct AJAX call that the attacker can craft programmatically. The attack complexity is low, making it feasible for attackers with basic web security knowledge to automate exploitation at scale.

Remediation

Organizations should immediately update the Events Calendar for GeoDirectory plugin to a patched version released after 2.3.28. Verify the latest available version against the official WordPress plugin repository or the vendor's advisory. If an immediate patch is unavailable, consider disabling the plugin until a fix is released, or restrict plugin functionality through security policies while monitoring for suspicious activity.

Patch guidance

Check the official WordPress plugin repository or the vendor's security advisory for version 2.3.29 or later, which should include validation improvements to the ajax_ayi_action() handler. Apply the update in a staging environment first to verify compatibility with your site's other plugins and customizations. Verify against the vendor advisory that the patch specifically addresses input validation for the type and postid parameters.

Detection guidance

Monitor WordPress audit logs and user meta changes for unexpected wp_capabilities entries in user profiles, particularly for accounts that should not have Administrator roles. Watch for AJAX requests to the ajax_ayi_action() handler with suspicious type or postid values, especially those containing 'wp_capabilities' or 'administrator'. Examine user role changes that occur without corresponding admin actions in the WordPress dashboard. Use WordPress security scanning tools to identify installations of the vulnerable plugin version.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), low attack complexity, low privilege requirements, and severe impact. Any Subscriber-level account can become Administrator, making it critical for organizations with public user registration or multiple user tiers. The fact that this is not yet on the CISA KEV list does not reduce urgency; exploitation is straightforward and the impact is complete system compromise.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Network-based attack vector (no physical access needed), Low attack complexity (straightforward input manipulation), Low privilege requirement (Subscriber level suffices), No user interaction required, and severe impact across Confidentiality, Integrity, and Availability. This combination of accessibility and severity places it in the highest practical risk tier for WordPress environments.

Frequently asked questions