CVE-2026-3585: Arbitrary File Access in The Events Calendar

Successful exploitation of CVE-2026-3585 allows an authenticated attacker to bypass intended access controls and read any file accessible by the webserver process. This could include configuration files containing database credentials, private keys, or source code. The attacker's ability to read sensitive files depends on the webserver's permissions and file system structure. While requiring Author-level access limits the initial attack surface, compromised accounts with such privileges can be highly valuable to attackers. The potential for data exfiltration and subsequent compromise of the entire WordPress environment is significant.

1. Reserved2026-03-05
2. Published2026-03-10
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-3585 is to immediately upgrade The Events Calendar plugin to version 6.15.17.1 or later. If upgrading is not immediately feasible, consider restricting file system permissions to minimize the potential impact of a successful attack. Implement a Web Application Firewall (WAF) with rules to block requests targeting the 'ajaxcreateimport' endpoint with suspicious file paths. Regularly review WordPress user roles and permissions to ensure the principle of least privilege is enforced.

Active installs

700KPopular

Plugin rating