CVE-2026-3585

High

Published: 10 March 2026

Published

10 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0008 23.6th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-3585 is a high-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-3585 is a path traversal vulnerability (CWE-22) affecting The Events Calendar plugin for WordPress in all versions up to and including 6.15.17. The issue resides in the 'ajax_create_import' function, enabling attackers to bypass intended file access restrictions and read arbitrary files stored on the server. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting high confidentiality impact with low complexity and no privileges required according to the vector, though exploitation details specify authentication requirements.

Authenticated attackers with Author-level access or higher can exploit this vulnerability remotely over the network. By sending crafted requests to the 'ajax_create_import' function, they can traverse directory paths to access and exfiltrate the contents of sensitive files on the web server, such as configuration files, credentials, or other proprietary data.

Mitigation guidance is available in related advisories, including those from Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/92e404ab-fe2b-45b3-b8ff-672f7888b747?source=cve) and CleanTalk research (https://research.cleantalk.org/cve-2026-3585/), as well as the vulnerable source code at https://plugins.trac.wordpress.org/browser/the-events-calendar/tags/6.15.17/src/Tribe/Aggregator/Tabs/New.php#L466. Security practitioners should update to a plugin version beyond 6.15.17 where the issue has been addressed.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-10470

Vulnerability details

The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents…

of arbitrary files on the server, which can contain sensitive information.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing WordPress plugin enables remote file read (T1190 exploitation vector; T1005 arbitrary local file access; T1552.001 credential/config file exfiltration).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1