CVE-2026-3585 - The Events Calendar <= 6.15.17 - authenticated (author+) arbitrary file read via ...

CVE ID :CVE-2026-3585 Published : March 10, 2026, 3:33 a.m. | 1 hour, 10 minutes ago Description :The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...