CVE-2026-3585 is a path traversal vulnerability in the The Events Calendar WordPress plugin (up to version 6.15.17). It allows authenticated users with Author-level privileges or above to leverage the 'ajax_create_import' function to read arbitrary files on the server by bypassing pathname restrictions. This vulnerability is classified under CWE-22 and has a CVSS 3.1 base score of 7.5, indicating high severity. The issue enables unauthorized disclosure of sensitive server files but does not affect integrity or availability. No patch or official fix has been documented yet, and no public exploits are known.

Successful exploitation allows an authenticated attacker with Author-level access or higher to read arbitrary files on the server hosting the plugin. This can lead to disclosure of sensitive information, potentially compromising confidentiality. There is no indication of impact on data integrity or availability. The vulnerability affects all plugin versions up to 6.15.17.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious activity related to the 'ajax_create_import' function. Avoid exposing sensitive files on the server that could be accessed via path traversal.