Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajaxayiaction() handler only applying striptags(escsql()) — with no allow-list — to the attacker-controlled $POST['type'] and $POST['postid'] values before forwarding them to updateayidata(), which calls updateusermeta($currentuser->ID, $rsvpargs['type'], $posts). By passing type=wpcapabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wpcapabilities user meta; WPUser::getrolecaps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.