CVE-2026-11616 is a privilege escalation vulnerability in the Events Calendar for GeoDirectory WordPress plugin (stiofansisland). The ajax_ayi_action() handler inadequately sanitizes attacker-controlled POST parameters 'type' and 'postid' by only applying strip_tags and esc_sql without an allow-list. This allows an attacker to pass 'type=wp_capabilities' and 'postid=administrator', causing update_user_meta() to write elevated capabilities into their user meta. As a result, WP_User::get_role_caps() interprets the manipulated data as an Administrator role on subsequent requests, enabling privilege escalation from Subscriber or higher to Administrator.

An authenticated attacker with Subscriber-level privileges or above can escalate their privileges to Administrator, gaining full control over the WordPress site. This includes the ability to modify site content, settings, install plugins, and potentially compromise the entire site integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's ajax_ayi_action() endpoint to trusted users only or disable the plugin if possible to prevent exploitation.