CVE-2026-39532: WordPress Events Calendar for GeoDirectory plugin <= 2.3.25 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection vulnerability in the Events Calendar for GeoDirectory WordPress plugin affects all versions up to and including 2.3.25. The flaw is reachable over the network and requires only a low-privilege (Contributor-level) WordPress account, with no additional interaction needed. Successful exploitation allows an attacker to read sensitive data, tamper with site content or stored data, and disrupt service availability. HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege WordPress account at Contributor level or above is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No user interaction is required; the attacker can trigger the injection directly without social engineering or victim participation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental prerequisites.

Blast Radius

• Reads sensitive WordPress data including user records, session tokens, and plugin configuration stored in the database.
• Modifies or deletes persisted site content, database rows, and plugin state, enabling defacement or data corruption.
• Crashes or degrades the affected WordPress service, causing availability disruption for site visitors and administrators.
• Depending on available PHP deserialization gadget chains in the environment, the injection may chain to remote code execution on the container host.