CVE-2026-11616: GeoDirectory Events Privilege Escalation

CVE-2026-11616 Overview

CVE-2026-11616 is a privilege escalation vulnerability in The Events Calendar for GeoDirectory plugin for WordPress, affecting all versions up to and including 2.3.28. The flaw resides in the ajax_ayi_action() handler, which fails to validate attacker-controlled $_POST parameters before passing them to update_user_meta(). An authenticated attacker with Subscriber-level access can manipulate the type and postid parameters to overwrite their own wp_capabilities user meta, granting themselves the Administrator role. This vulnerability is tracked under [CWE-269] (Improper Privilege Management).

Critical Impact
Authenticated users with Subscriber-level access can escalate to Administrator, gaining full control of the WordPress site, including content, plugins, users, and the underlying database.

Affected Products

The Events Calendar for GeoDirectory plugin for WordPress, versions up to and including 2.3.28
WordPress installations with the vulnerable plugin enabled
Any user role at Subscriber level or above on affected sites

Discovery Timeline

2026-06-09 - CVE-2026-11616 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11616

Vulnerability Analysis

The vulnerability resides in the ajax_ayi_action() AJAX handler located in class-geodir-event-ayi.php. The handler applies only strip_tags(esc_sql()) to the $_POST['type'] and $_POST['postid'] parameters. No allow-list validation restricts these values to expected RSVP-related keys.

The sanitized but unvalidated values are forwarded to update_ayi_data(), which executes update_user_meta($current_user->ID, $rsvp_args['type'], $posts). Because the meta key is fully attacker-controlled, an attacker can write to any user meta entry belonging to themselves, including the security-critical wp_capabilities key.

When the attacker submits type=wp_capabilities and postid=administrator, the plugin writes an array such as ['subscriber'=>true,'administrator'=>'administrator'] into the attacker's wp_capabilities meta. On the next request, WP_User::get_role_caps() enumerates this array and treats the administrator key as an active role.

Root Cause

The root cause is missing authorization and missing input allow-listing. The handler trusts user-supplied values for the meta key argument of update_user_meta(). SQL-focused sanitization functions like esc_sql() do not prevent logical abuse of the WordPress capability model.

Attack Vector

An attacker authenticates with any account at Subscriber level or above. The attacker then sends a crafted POST request to the ayi_action AJAX endpoint with type=wp_capabilities and postid=administrator. The plugin overwrites the user's wp_capabilities meta, and the next authenticated request grants administrative capabilities. No user interaction from a privileged victim is required.

For technical specifics, see the vulnerable handler at line 154 and the meta update logic at line 357.

Detection Methods for CVE-2026-11616

Indicators of Compromise

POST requests to admin-ajax.php containing action=ayi_action with type=wp_capabilities in the request body
Unexpected modifications to the wp_usermeta table where meta_key='wp_capabilities' for non-administrator accounts
New or existing low-privilege users suddenly performing administrative actions such as plugin installation or user creation
Subscriber-level accounts accessing /wp-admin/ pages reserved for administrators

Detection Strategies

Inspect web server access logs for AJAX requests where type parameters reference WordPress core meta keys such as wp_capabilities, wp_user_level, or session_tokens
Compare current role assignments in wp_usermeta against a known-good baseline to identify unauthorized role changes
Alert on WordPress audit log events where a Subscriber-tier account transitions to Administrator outside of approved workflows

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward events to a centralized SIEM for correlation
Monitor authentication events for newly elevated accounts performing privileged operations within minutes of role change
Track plugin file integrity for class-geodir-event-ayi.php and related files to confirm patched versions are deployed

How to Mitigate CVE-2026-11616

Immediate Actions Required

Update The Events Calendar for GeoDirectory plugin to a version above 2.3.28 that includes the upstream fix referenced in the WordPress change set 3533585
Audit all WordPress user accounts and revoke unexpected Administrator privileges
Review wp_usermeta entries for tampering in the wp_capabilities field across all users
Rotate credentials and force password resets for any account suspected of compromise

Patch Information

The vendor addressed the vulnerability in a release following 2.3.28. Refer to the Wordfence Vulnerability Report for the fixed version and the WordPress change set for the upstream code fix. The patch introduces allow-list validation restricting the type parameter to expected RSVP values.

Workarounds

Disable The Events Calendar for GeoDirectory plugin until the patched version is installed
Restrict new user registration to trusted users only, reducing the attacker pool that can reach the vulnerable AJAX endpoint
Deploy a Web Application Firewall (WAF) rule blocking POST requests to admin-ajax.php containing action=ayi_action together with type=wp_capabilities
Remove Subscriber-level registration on production sites where it is not required

bash

# Example WAF rule (ModSecurity) blocking exploitation attempts
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026116160,msg:'CVE-2026-11616 GeoDirectory privilege escalation attempt'"
  SecRule ARGS:action "@streq ayi_action" "chain"
  SecRule ARGS:type "@rx (wp_capabilities|wp_user_level|session_tokens)"