EUVD-2026-35375
GHSA-j857-hxgm-cvxf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) - with no allow-list - to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.
Articles & Coverage 2
AnalysisAI
Privilege escalation in the Events Calendar for GeoDirectory WordPress plugin (versions up to and including 2.3.28) allows authenticated Subscriber-level users to elevate to Administrator by abusing the ajax_ayi_action() AJAX handler, which writes attacker-controlled POST parameters directly into the wp_capabilities user meta key. The flaw stems from insufficient input filtering (strip_tags/esc_sql with no allow-list) on the type and postid fields before they reach update_user_meta(), enabling an attacker to set their own role to administrator. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
The vulnerable code path lives in includes/class-geodir-event-ayi.php within the events-for-geodirectory plugin (CPE cpe:2.3:a:stiofansisland:events_calendar_for_geodirectory). The ajax_ayi_action() handler accepts user-supplied $_POST['type'] and $_POST['postid'] and forwards them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). Because the sanitization is limited to strip_tags(esc_sql()) - designed to neutralize HTML and SQL metacharacters but not to constrain values to a safe allow-list - the meta key parameter can be set to the WordPress reserved key wp_capabilities. WordPress core (WP_User::get_role_caps()) reads this meta on every request and treats any array key as an active role, so writing ['administrator' => 'administrator'] grants full Administrator capabilities. The root cause class is CWE-269 (Improper Privilege Management), specifically a missing allow-list on a meta-key write primitive that intersects with a privileged identity store.
RemediationAI
Upstream fix available (commit/changeset 3533585 on plugins.trac.wordpress.org for events-for-geodirectory); a released patched version greater than 2.3.28 is not independently confirmed from the provided data, so administrators should update to the latest available release of Events Calendar for GeoDirectory beyond 2.3.28 as published on the WordPress.org plugin repository and verify the changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3533585%40events-for-geodirectory&new=3533585%40events-for-geodirectory is included. If immediate patching is not possible, disable or fully remove the plugin (the AJAX handler is loaded for any authenticated request, so deactivation eliminates the primitive), tighten user-registration settings so untrusted users cannot obtain Subscriber accounts, and use a WAF rule to block POST requests to the admin-ajax.php action handling ayi where the type parameter equals wp_capabilities or the postid parameter equals administrator - note that blocking only those literal values can be bypassed if other reserved meta keys (for example, wp_user_level) are similarly writable, so prefer plugin removal over rule-based mitigation. Also audit existing users for unexpected administrator capabilities, since exploitation leaves a persistent role grant in user meta.
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today