Events Calendar for GeoDirectory CVE-2025-26967

Immediately upgrade Events Calendar for GeoDirectory plugin to version 2.3.15 or later if available, verifying the release specifically addresses CVE-2025-26967 through the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/events-for-geodirectory/vulnerability/wordpress-events-calendar-for-geodirectory-plugin-2-3-14-php-object-injection-vulnerability. If patched version release is delayed, implement compensating controls: restrict user registration and limit authenticated access to only trusted administrators until patching is complete, disable the Events Calendar for GeoDirectory plugin entirely if event functionality is non-critical, implement web application firewall rules to detect and block serialized object patterns in POST request bodies targeting the plugin's endpoints (note: may break legitimate functionality requiring careful testing), and enable comprehensive WordPress audit logging to detect suspicious deserialization attempts or privilege escalation. Review existing user accounts for unauthorized privilege changes that might indicate prior exploitation. After patching, conduct security review of any user-submitted event data or imported content from the vulnerable period.