CVE-2026-11616: stiofansisland events calendar for geodirectory Improper Privilege Management

Vulnerability summary

CVE-2026-11616 is a high (CVSS 8.8) Improper Privilege Management vulnerability in stiofansisland events calendar for geodirectory. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.8% of scored vulnerabilities. Fixed in 2.3.29.

Timeline

1. 09-06-2026
   PublishedVulnerability first disclosed.
2. 09-06-2026
   Last modifiedVulnerability information updated.

Description

The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.