Privilege Escalation in The Events Calendar for GeoDirectory WordPress Plugin

CVE-2026-11616 is a privilege escalation vulnerability in The Events Calendar for GeoDirectory plugin for WordPress affecting versions up to and including 2.3.28. The flaw is in the ajax_ayi_action() handler, which accepts attacker-controlled $_POST['type'] and $_POST['postid'] values and only applies strip_tags(esc_sql()) before passing them to update_ayi_data(). No allow-list or other restriction is enforced on the meta key supplied via type. update_ayi_data() subsequently calls update_user_meta($current_user->ID, $rsvp_args['type'], $posts), allowing a logged-in attacker to write arbitrary values into their own user meta under an attacker-chosen key. By supplying type=wp_capabilities and postid=administrator, the attacker can cause their wp_capabilities user meta to contain ['subscriber'=>true,'administrator'=>'administrator']. On the next request, WordPress role resolution via WP_User::get_role_caps() interprets the administrator array key as an active role, resulting in elevation of the attacker's account to Administrator.