CVE-2026-11616: Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajaxayiaction() handler only applying striptags(escsql()) — with no allow-list — to the attacker-controlled $POST['type'] and $POST['postid'] values before forwarding them to updateayidata(), which calls updateusermeta($currentuser->ID, $rsvpargs['type'], $posts). By passing type=wpcapabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wpcapabilities user meta; WPUser::getrolecaps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/events-calendar-for-geodirectoryfrom your environment.If the Events Calendar for GeoDirectory plugin is not required, uninstall the plugin from WordPress to remove the vulnerable ajax_ayi_action handler.
- Compensating control
Deploy a compensating control (WAF/firewall) to block or restrict requests to the plugin's AJAX handler. For example, block POST requests to the relevant admin AJAX endpoint that include POST parameters type=wp_capabilities or postid=administrator, or restrict access to admin-ajax.php to trusted IPs / authenticated administrator IP ranges until an official fix is available.
- Operational
Audit WordPress user meta for signs of exploitation: inspect wp_usermeta entries for the meta_key 'wp_capabilities' and remove any unexpected 'administrator' role keys. Revoke unauthorized administrator privileges, rotate credentials for any accounts that may have been upgraded, and invalidate active sessions for affected accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11616?
CVE-2026-11616 has a high severity rating of 8.8.
What type of vulnerability is CVE-2026-11616?
CVE-2026-11616 is a privilege escalation vulnerability affecting the Events Calendar for GeoDirectory.
How do I fix CVE-2026-11616?
To fix CVE-2026-11616, update the Events Calendar for GeoDirectory plugin to a version beyond 2.3.28.
What versions are affected by CVE-2026-11616?
CVE-2026-11616 affects versions of the Events Calendar for GeoDirectory up to and including 2.3.28.
Can CVE-2026-11616 be exploited by unauthenticated users?
No, CVE-2026-11616 requires authentication as a Subscriber or higher to exploit.