CVE-2026-3585: The Events Calendar Path Traversal Flaw

CVE-2026-3585 Overview

The Events Calendar plugin for WordPress contains a Path Traversal vulnerability in all versions up to and including 6.15.17. The vulnerability exists in the ajax_create_import function, allowing authenticated attackers with Author-level access or higher to read the contents of arbitrary files on the server. This type of vulnerability can expose sensitive information such as configuration files, database credentials, and other critical system data.

Critical Impact

Authenticated attackers can read arbitrary files on the server, potentially exposing sensitive configuration data, credentials, and other confidential information.

Affected Products

• The Events Calendar plugin for WordPress versions up to and including 6.15.17

Discovery Timeline

• March 10, 2026 - CVE-2026-3585 published to NVD
• March 11, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3585

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), a common weakness where user input is not properly sanitized before being used to construct file paths. In the context of The Events Calendar plugin, the ajax_create_import function fails to adequately validate or sanitize user-supplied input, enabling attackers to traverse directory structures and access files outside the intended scope.

The attack requires authentication with at least Author-level privileges on the WordPress site, which limits the attack surface but still presents significant risk in multi-user WordPress environments. Successful exploitation could result in disclosure of sensitive server-side files including wp-config.php, which typically contains database credentials, authentication keys, and other critical configuration parameters.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the ajax_create_import function located in the plugin's aggregator import functionality. The function processes file path parameters without properly sanitizing directory traversal sequences such as ../ or encoded variants. This allows an authenticated attacker to manipulate the file path and escape the intended directory structure to access arbitrary files on the server.

The vulnerable code can be reviewed in the WordPress Code Review at line 466 of New.php.

Attack Vector

The attack is network-based and requires the attacker to have valid WordPress credentials with at least Author-level access. The attacker would send a crafted AJAX request to the ajax_create_import endpoint, including path traversal sequences in the file parameter. When the server processes this request, it follows the traversal sequences and returns the contents of the specified file.

The vulnerability allows for reading arbitrary files with the permissions of the web server process, which typically includes access to most files within the web root and potentially sensitive system files depending on server configuration.

For detailed technical information about the vulnerability mechanism, see the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3585

Indicators of Compromise

• Unusual AJAX requests to The Events Calendar import endpoints containing path traversal sequences (../, %2e%2e%2f, etc.)
• Web server logs showing access attempts to ajax_create_import with suspicious path parameters
• Access logs indicating requests for sensitive files like wp-config.php through the plugin's import functionality
• Unexpected file access patterns from the web server process to system configuration files

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in requests to WordPress AJAX endpoints
• Monitor WordPress activity logs for unusual import operations performed by Author-level users
• Deploy file integrity monitoring on sensitive configuration files to detect unauthorized access attempts
• Review web server access logs for requests containing encoded directory traversal sequences

Monitoring Recommendations

• Enable detailed logging for The Events Calendar plugin activities, particularly the aggregator import functionality
• Configure alerts for any access attempts to sensitive files such as wp-config.php, .htaccess, or system password files
• Monitor authentication logs for suspicious Author-level account activity that may indicate compromised credentials being used for exploitation

How to Mitigate CVE-2026-3585

Immediate Actions Required

• Update The Events Calendar plugin to a version newer than 6.15.17 that addresses this vulnerability
• Review web server logs for any indicators of exploitation attempts
• Audit Author-level and above WordPress user accounts to ensure they are legitimate
• Consider temporarily disabling the plugin's import functionality until the patch is applied

Patch Information

Update The Events Calendar plugin to the latest available version that contains the security fix. Plugin updates can be applied through the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI using the command wp plugin update the-events-calendar. Always back up your WordPress installation before applying updates.

For additional details, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict Author-level account access to only trusted users until the patch is applied
• Implement server-level restrictions using .htaccess or web server configuration to block requests containing path traversal patterns
• Deploy a Web Application Firewall (WAF) with rules to detect and block directory traversal attacks
• Consider using PHP's open_basedir directive to restrict file access to the WordPress directory structure

# Example .htaccess rule to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.) [NC,OR]
    RewriteCond %{QUERY_STRING} (%2e%2e%2f|%2e%2e/) [NC]
    RewriteRule .* - [F,L]
</IfModule>