Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_action() handler only applying strip_tags(esc_sql()) — with no allow-list — to the attacker-controlled $_POST['type'] and $_POST['postid'] values before forwarding them to update_ayi_data(), which calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts). By passing type=wp_capabilities and postid=administrator, an attacker writes ['subscriber'=>true,'administrator'=>'administrator'] into their own wp_capabilities user meta; WP_User::get_role_caps() then treats the 'administrator' array key as an active role on the next request. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-09 | 2 | Disclosure2 |
| 2026-06-10 | 2 | General1PoC1 |
Confira meu artigo mais recente: escalação de previlegios | CVE-2026-11616 https://www.linkedin.com/pulse/escala%25C3%25A7%25C3%25A3o-de-previlegios-cve-2026-11616-tarc%25C3%25ADsio-luchesi-poystick--oc4df via @LinkedIn
Post summary
The text merely announces an article about CVE-2026-11616 without providing any exploit details, patches, or technical specifics.
https://atomicedge.io/cve-proof/cve-2026-11616-events-for-geodirectory-version-2-3-28-high-vulnerability-proof-of-concept CVE-2026-11616 events-for-geodirectory (CVSS Score 8.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wps…
Post summary
The post is a proof‑of‑concept for CVE‑2026‑11616 with a high CVSS score, but it does not disclose any functional exploit, active exploitation, patch, or false‑positive claim.
🚨*CVE* CVE-2026-11616 The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_ac… https://www.cve.org/CVERecord?id=CVE-2026-11616 ----- Traducción: CVE-2026-11616 El … http://infoflow.cloud`
Post summary
The text announces CVE-2026-11616, a privilege escalation flaw in the Events Calendar for GeoDirectory WordPress plugin affecting versions up to 2.3.28, with no PoC, exploit, patch, or active exploitation reported.
CVE-2026-11616 The Events Calendar for GeoDirectory plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.3.28. This is due to the ajax_ayi_ac… https://www.cve.org/CVERecord?id=CVE-2026-11616
Post summary
The text announces CVE-2026-11616, a privilege‑escalation flaw in the Events Calendar for GeoDirectory plugin up to version 2.3.28, without providing exploitation details or patches.