Executive brief
A vulnerability in a popular WordPress plugin for managing event calendars allows users with low-level accounts to grant themselves administrative control over the entire website. By exploiting a flaw in how the plugin handles user data, an attacker can bypass security restrictions to gain full access to sensitive site settings and customer information. This could lead to a complete site takeover, data theft, or service disruption.
Technical details
The vulnerability exists in the ajax_ayi_action() handler due to insufficient validation of the 'type' and 'postid' POST parameters. These values are passed to update_ayi_data() and subsequently to update_user_meta() without an allow-list, enabling an attacker to overwrite their own 'wp_capabilities' meta field. By setting the 'type' to 'wp_capabilities' and 'postid' to 'administrator', an authenticated user with Subscriber-level access or higher can inject administrative roles into their profile. This results in full privilege escalation to the Administrator role upon the next request. The issue is present in versions up to and including 2.3.28.
Affected products
- GeoDirectory The Events Calendar for GeoDirectory up to and including 2.3.28
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
References
- https://plugins.trac.wordpress.org/browser/events-for-geodirectory/tags/2.3.28/includes/class-geodir-event-ayi.php
- https://plugins.trac.wordpress.org/browser/events-for-geodirectory/tags/2.3.28/includes/class-geodir-event-ayi.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3533585%40events-for-geodirectory&new=3533585%40events-for-geodirectory&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/11ba187b-1fe4-4077-ad9d-a07660133e91?source=cve