CVE-2026-3585

Name of the Vulnerable Software and Affected Versions The Events Calendar plugin for WordPress versions prior to 6.15.18

Description The Events Calendar plugin for WordPress is susceptible to a Path Traversal issue in versions up to and including 6.15.17. This allows authenticated attackers with Author-level access or higher to read arbitrary files on the server, potentially exposing sensitive information. The issue resides within the ajax create import function.

Recommendations Update The Events Calendar plugin to version 6.15.18 or later.