What is the CVSS score of EUVD-2026-36961?

EUVD-2026-36961 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Events Calendar for GeoDirectory are affected by EUVD-2026-36961?

The Events Calendar for GeoDirectory WordPress plugin (versions 2.3.25 and earlier) contains a high-severity object injection vulnerability (CVE-2026-39532) enabling authenticated Contributor users…

How to fix or mitigate EUVD-2026-36961?

Within 24 hours: Identify all WordPress installations running Events Calendar for GeoDirectory version 2.3.25 or earlier and audit Contributor+ user accounts for necessity and legitimacy. Within 7 days: Restrict Contributor role permissions to only essential, vetted users or consider disabling the plugin if not actively used. Within 30 days: Monitor Patchstack and plugin vendor channels for a released patch and plan upgrade once available.

Events Calendar for GeoDirectory EUVD-2026-36961

| CVE-2026-39532 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-7h33-9rg2-h2qq

PHP Deserialization Events Calendar For Geodirectory

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N), low complexity once a gadget exists (AC:L), requires Contributor account (PR:L), no user interaction (UI:N); deserialization typically yields full C/I/A impact on the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:19 vuln.today

DescriptionCVE.org

Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.

AnalysisAI

PHP Object Injection in the Events Calendar for GeoDirectory WordPress plugin (versions <= 2.3.25) allows authenticated users with Contributor-level privileges to trigger unsafe deserialization, potentially leading to remote code execution, data tampering, or denial of service on the host WordPress site. The flaw is tracked as CWE-502 and was disclosed via Patchstack with a CVSS 3.1 score of 8.8, but no public exploit identified at time of analysis. Patchstack reports the issue and no vendor-released patch identified at time of analysis based on the supplied data.

Technical ContextAI

The vulnerable component is the Events Calendar for GeoDirectory WordPress plugin (CPE cpe:2.3:a:stiofan:events_calendar_for_geodirectory), an add-on that extends the GeoDirectory directory plugin with event listings. The root cause is CWE-502 (Deserialization of Untrusted Data): PHP's unserialize() reconstructs objects from attacker-controlled input, which can invoke magic methods such as __wakeup or __destruct on gadget classes loaded by WordPress core, GeoDirectory, or other active plugins. When a viable POP (Property Oriented Programming) gadget chain is reachable in the runtime, deserialization can be escalated from object instantiation into file writes, arbitrary code execution, or sensitive data disclosure.

RemediationAI

No vendor-released patch identified at time of analysis based on the supplied input, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/events-for-geodirectory/vulnerability/wordpress-events-calendar-for-geodirectory-plugin-2-3-25-php-object-injection-vulnerability) and the WordPress.org plugin page for an updated release above 2.3.25 and upgrade as soon as one is published. Until a fix is available, deactivate and remove the Events Calendar for GeoDirectory plugin if event functionality is not business-critical (side effect: loss of event listings on the directory site), or at minimum restrict who can hold the Contributor role and audit existing Contributor accounts for unfamiliar users (side effect: editorial friction for legitimate guest authors). As compensating controls, deploy a WordPress-aware WAF such as Patchstack or Wordfence with a virtual patch for this CVE, and disable or block plugin endpoints that accept serialized payloads from Contributor-authored content (side effect: may break event submission workflows for low-privileged authors).