Path Traversal Vulnerability in The Events Calendar Plugin for WordPress

CVE-2026-3585

What is CVE-2026-3585?

The Events Calendar plugin for WordPress is affected by a path traversal vulnerability through the 'ajax_create_import' function. Authenticated attackers with Author-level access or higher can exploit this flaw to access and read sensitive files on the server. This allows them to potentially extract sensitive information stored on the system, posing a significant risk to the integrity and confidentiality of the site's data.

References