What the vulnerability does
01Description
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.
Explanation of Vulnerability in Simple Terms
02Summary
Events Calendar for GeoDirectory versions up to 2.3.28 contain a privilege management flaw that allows authenticated users with low-level access to perform actions restricted to higher-privilege roles. An attacker with a basic user account can read, modify, or delete sensitive data and disrupt site operations. No user interaction is required once the attacker is logged in.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete data and disrupt site operations with a low-privilege user account.
Potential impact on your site
04Site Impact
Unauthorized users can access and alter calendar events, user data, and site settings without admin approval.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account on the site.
Key dates
06Disclosure timeline
June 9, 2026
CVE published
June 9, 2026
Record updated
