WordPress Security Bulletin: The The Events Calendar plugin Vulnerability (CVE-2026-3585)

Security Alert Summary

The The Events Calendar plugin for WordPress contains a path traversal vulnerability in the ajax_create_import function that, according to the CVE entry, can allow an attacker to read arbitrary files on the server. The issue affects all versions up to and including 6.15.17 and can expose sensitive file contents.

CVE Details

• CVE ID: CVE-2026-3585
• Affected component: The The Events Calendar plugin for WordPress
• Affected versions: All versions up to, and including, 6.15.17
• Published: March 10, 2026 at 5:40:37 PM UTC
• Last modified: March 11, 2026 at 1:53:47 PM UTC
• CVSS v3.1: Base Score 7.5 — HIGH
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE (as reported in CVSS data)
  • User Interaction: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE
• Authentication / access noted in description: The CVE description states exploitation is possible by authenticated attackers with Author-level access and above.
• Weakness (CWE): CWE-22 (Path Traversal)

Technical Details

According to the CVE entry, the vulnerability is a path traversal issue originating in the ajax_create_import function of the plugin. Path traversal weaknesses (CWE-22) allow crafted input to reference files outside the intended directory, enabling an attacker to read arbitrary files on the server when proper path validation or sanitization is missing.

The described impact is the ability for an attacker to read the contents of arbitrary server files. The CVE identifies the function name ajax_create_import as the affected component; no additional endpoints, missing permission checks, or full exploit details are provided in the CVE entry itself.

How This Could Impact Your Website

In a typical WordPress site with multiple users, an internal contributor or external contractor who has Author-level access (or higher, per the CVE description) could exploit this vulnerability to read files on the web server. That might include configuration files, backup files, or other data that contain sensitive information such as database connection strings or user data.

Practical consequences include exposure of internal user email addresses and other stored information, which can increase the risk of targeted phishing or social engineering against staff and contributors. The vulnerability as described impacts confidentiality primarily; it does not indicate integrity or availability impacts in the CVE data.

professional review — If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

• Update the affected plugin as soon as a patched version is available. (The CVE notes affected versions up to and including 6.15.17; a fixed version is not specified in the CVE entry.)
• Review and reduce unnecessary user roles, especially contributors and authors.
• Enforce strong passwords and two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins.
• Monitor site activity and logs for unusual behavior, including unexpected file access patterns.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.17/src/Tribe/Aggregator/Tabs/New.php#L466
• https://www.wordfence.com/threat-intel/vulnerabilities/id/92e404ab-fe2b-45b3-b8ff-672f7888b747?source=cve