What is the CVSS score of CVE-2026-3585?

CVE-2026-3585 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3585?

The Events Calendar WordPress plugin (versions ≤6.15.17) contains a path traversal vulnerability that could allow attackers to access sensitive files on affected websites.

How to fix or mitigate CVE-2026-3585?

Within 24 hours: Inventory all WordPress installations using Events Calendar and document affected versions. Within 7 days: Implement WAF rules to block path traversal patterns targeting the plugin, or disable the plugin if not critical to operations. Within 30 days: Monitor vendor release channels for a patch and plan immediate deployment upon availability; consider alternative calendar plugins if no patch timeline is provided.

WordPress CVE-2026-3585

HIGH

Path Traversal (CWE-22)

2026-03-10 security@wordfence.com

WordPress Path Traversal

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 17:40 nvd

HIGH 7.5

DescriptionCVE.org

The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

The Events Calendar (WordPress plugin) versions up to 6.15.17 is affected by path traversal (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-22: Path Traversal) affects The Events Calendar (WordPress plugin). The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected ProductsAI

Vendor: WordPress. Product: The Events Calendar (WordPress plugin). Versions: up to 6.15.17.

RemediationAI

Monitor vendor advisories for a patch. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.