CVE-2026-11616: Events Calendar for GeoDirectory <= 2.3.28 - Authenticated (Subscriber+) Privilege Escalation

Synopsis

This is a privilege escalation vulnerability in the Events Calendar for GeoDirectory plugin for WordPress, affecting all versions up to and including 2.3.28. The flaw is reachable over the network by any authenticated user with at least a Subscriber-level account, with no further conditions required. Successful exploitation lets an attacker overwrite their own WordPress role metadata and immediately gain Administrator-level access to the WordPress site. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as the upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX handler is exposed over the network, so an attacker must be able to reach the WordPress site via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account at Subscriber level or above is sufficient; no elevated or administrative credentials are needed.

• Victim interactionNot required

  The attacker sends a crafted POST request directly; no action from another user or administrator is needed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply supplies controlled POST parameters with no race conditions or environmental factors to overcome.

Blast Radius

• Attacker writes arbitrary WordPress user-meta values, specifically the wp_capabilities key, to promote their account to Administrator.
• With Administrator access, the attacker can install or modify plugins and themes, execute arbitrary PHP code, and take full control of the WordPress application.
• All content, configuration, stored user data, and credentials held in the WordPress database become readable and modifiable.
• The attacker can create additional backdoor accounts or delete existing users, causing persistent disruption to the site and its users.