Privilege Escalation Vulnerability in Events Calendar for GeoDirectory Plugin by WordPress

CVE-2026-11616

What is CVE-2026-11616?

The Events Calendar for GeoDirectory plugin for WordPress has a privilege escalation vulnerability in versions up to and including 2.3.28. This issue stems from the improper handling of user inputs in the ajax_ayi_action() function, where the inputs from the attacker-controlled $_POST['type'] and $_POST['postid'] are inadequately sanitized. By manipulating these inputs, an authenticated attacker with Subscriber-level access can escalate their privileges to Administrator status, gaining unauthorized control over the WordPress site. This vulnerability highlights the importance of rigorous input validation and the potential for exploitation through improper handling of user permissions.

References