CVE-2026-39532 is a deserialization vulnerability in Events Calendar for GeoDirectory (Stiofan) affecting versions up to and including 2.3.25. The vulnerability allows an attacker with low privileges to inject malicious PHP objects during deserialization, potentially leading to remote code execution or other severe impacts. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official fix or patch has been disclosed as of the publication date.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. An attacker may execute arbitrary code or manipulate application behavior due to unsafe deserialization of untrusted data. This poses a significant risk to systems running vulnerable versions of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions (<=2.3.25) in production environments or apply compensating controls such as disabling or restricting plugin functionality if possible.