The Events Calendar <= 6.15.17 - 认证 (作者+) 通过 ajax_create_import 实现任意文件读取

攻击者可以利用此漏洞访问服务器上的任意文件。这可能包括包含数据库凭据、API 密钥、配置文件或其他敏感信息的配置文件。成功利用此漏洞可能导致数据泄露、系统入侵，甚至可能导致攻击者完全控制受影响的 WordPress 站点。由于该漏洞需要经过身份验证，攻击者通常需要先获得对 WordPress 站点的访问权限，例如通过弱密码或跨站脚本攻击。然而，一旦获得访问权限，攻击者就可以轻松地利用此漏洞。

WordPress websites utilizing The Events Calendar plugin, particularly those with Author-level users or higher, are at risk. Shared hosting environments where users have limited control over server file permissions are especially vulnerable. Sites with outdated plugin versions and inadequate security practices are also at increased risk.

• wordpress / composer / npm: Use wp-cli plugin update to check the installed version of The Events Calendar.

wp plugin list --status=active | grep 'The Events Calendar'

• generic web: Monitor web server access logs for requests to wp-content/plugins/the-events-calendar/ajaxcreateimport with unusual or potentially malicious file paths in the parameters.

grep 'ajax_create_import' /var/log/apache2/access.log

• wordpress / composer / npm: Examine the the-events-calendar plugin files for any unauthorized modifications or backdoors.

find /var/www/html/wp-content/plugins/the-events-calendar -type f -mtime -7

1. 2026-03-10Disclosure

   disclosure

1. 已保留2026-03-05
2. 发布日期2026-03-10
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

最有效的缓解措施是立即将 The Events Calendar 插件升级至 6.15.17.1 或更高版本。如果无法立即升级，可以考虑实施一些临时缓解措施。首先，限制 WordPress 用户的权限，确保只有授权用户才能访问插件的管理员功能。其次，实施 Web 应用防火墙 (WAF) 规则，以阻止对 ajaxcreateimport 函数的恶意请求。最后，监控 WordPress 站点的日志文件，以查找任何可疑活动。