This vulnerability (CVE-2026-39532) is a PHP Object Injection issue classified under CWE-502, occurring in the Events Calendar for GeoDirectory plugin by Stiofan. It affects versions up to 2.3.25 and involves deserialization of untrusted data, which can lead to remote code execution or other severe impacts. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. As of the published date, no official remediation or patch is available, and no known exploits are reported in the wild.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute arbitrary code or cause significant compromise to confidentiality, integrity, and availability of the affected system. This could lead to full system compromise or data breaches in environments using vulnerable versions of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin functionality, applying strict input validation, or disabling the plugin if feasible to reduce exposure.