CVE-2026-3585: 
WordPress vulnerability analysis and mitigation

CVE-2026-3585 is a Path Traversal vulnerability in the The Events Calendar plugin for WordPress, developed by StellarWP. It affects all versions up to and including 6.15.17 via the ajax_create_import function, allowing authenticated attackers with Author-level access or above to read arbitrary files on the server. The vulnerability was published on March 10, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The flaw resides in the ajax_create_import function within src/Tribe/Aggregator/Tabs/New.php (line 466), where user-supplied input is not properly sanitized before being used in file system operations, enabling directory traversal sequences (e.g., ../) to escape the intended directory. An attacker with at least Author-level WordPress credentials can craft a malicious AJAX request to this function, supplying a traversal payload to reference files outside the web root, such as /etc/passwd or WordPress configuration files containing database credentials (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to read the contents of arbitrary files on the server, posing a significant confidentiality risk. Sensitive files such as wp-config.php (containing database credentials), environment configuration files, or system files like /etc/passwd could be exfiltrated. While integrity and availability are not directly impacted, exposed credentials could enable further attacks such as database access, privilege escalation, or full site compromise (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.056%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Wordfence Weekly Report).

1. Reconnaissance: Identify WordPress sites running The Events Calendar plugin version ≤ 6.15.17 using tools like WPScan or by checking the plugin's readme.txt file at /wp-content/plugins/the-events-calendar/readme.txt.
2. Obtain Author-level credentials: Register or compromise an account with at least Author-level access on the target WordPress site.
3. Craft malicious AJAX request: Send an authenticated POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the ajax_create_import action, injecting a path traversal payload (e.g., ../../../../wp-config.php) in the relevant parameter handled by the ajax_create_import function.
4. Read arbitrary file contents: The server processes the traversal payload without proper sanitization and returns the contents of the targeted file in the response, exposing sensitive data such as database credentials from wp-config.php or system files.
5. Leverage exposed credentials: Use any extracted credentials (e.g., database username/password) for further lateral movement, such as direct database access or escalating privileges within the WordPress environment (Wordfence, WordPress Trac).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with the ajax_create_import action and parameters containing path traversal sequences (e.g., ../, %2e%2e%2f, or URL-encoded variants).
• Logs: WordPress or web server access logs showing repeated AJAX requests to admin-ajax.php with suspicious file path parameters from Author-level user accounts; HTTP 200 responses to such requests with unexpectedly large response bodies.
• File System: No direct file system artifacts are expected from read-only exploitation, but monitor for subsequent unauthorized access to the database or configuration changes following potential credential theft.
• Process: Unexpected database connections from new or external IP addresses following exploitation, potentially indicating use of credentials extracted from wp-config.php.

Users should update The Events Calendar plugin to a version above 6.15.17 that includes a patch for this vulnerability. Until an update is available or applied, site administrators should restrict Author-level and above account creation to trusted users only, and consider using a Web Application Firewall (WAF) — such as Wordfence — to block path traversal attempts targeting AJAX endpoints. Monitoring WordPress AJAX logs for anomalous file path parameters is also recommended as a detective control (Wordfence, Sucuri Roundup).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for March 9–15, 2026, and Sucuri highlighted it in their March 2026 vulnerability patch roundup (Wordfence Weekly Report, Sucuri Roundup). RedPacket Security and Offseq also shared alerts about the CVE on social media platforms including Mastodon and X, contributing to broader community awareness shortly after disclosure.