High severity7.5NVD Advisory· Published Mar 10, 2026· Updated Apr 22, 2026

CVE-2026-3585

Description

The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/The Events Calendarllm-fuzzy
Range: <=6.15.17
Package: https://wordpress.org/plugins/the-events-calendar

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.17/src/Tribe/Aggregator/Tabs/New.phpnvd
research.cleantalk.org/cve-2026-3585/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/92e404ab-fe2b-45b3-b8ff-672f7888b747nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000