PT-2026-24176 · WordPress · The Events Calendar

Dmitry Ignatyev · Published 2026-03-10 · Updated 2026-03-11 · CVE-2026-3585

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions prior to 6.15.18

Description The Events Calendar plugin for WordPress is susceptible to a Path Traversal issue in versions up to and including 6.15.17. This allows authenticated attackers with Author-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. The issue resides within the ajax create import function.

Recommendations Update The Events Calendar plugin to version 6.15.18 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3585

Affected Products

The Events Calendar

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3585 · Security Note
• https://t.me/CVEtracker/46976 · Telegram Post
• https://twitter.com/CVEnew/status/2031294576317866226 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031428140552077414 · Twitter Post
• https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.17/src/Tribe/Aggregator/Tabs/New.php#L466 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/92e404ab-fe2b-45b3-b8ff-672f7888b747?source=cve · Note
• https://twitter.com/RedPacketSec/status/2031529327355981913 · Twitter Post
• https://research.cleantalk.org/cve-2026-3585 · Note