Contributor PHP Object Injection in Events Calendar for GeoDirectory plugin versions 2.3.25 and earlier enables an attacker to craft malicious serialized data that is deserialized by the plugin. This flaw provides remote code execution and can lead to full control over the affected WordPress site. The vulnerability resides in the plugin’s handling of contributor input, lacking proper input validation.

Affected systems include the WordPress Events Calendar for GeoDirectory plugin published by Stiofan. All releases up to and including 2.3.25 are vulnerable. Users of WordPress sites running any of these versions should assume the plugin is compromised.

The CVSS score of 8.8 marks this flaw as high severity. EPSS < 1% indicates a very low current exploitation probability, and it is not listed in CISA KEV. Nevertheless, the attack vector is likely remote via the plugin’s contributor feature and can be exploited by any party who can submit data to the plugin. Because the flaw permits remote code execution, administrators should prioritize applying the published update to at least 2.3.26.