CVE-2026-3585 | stellarwp Events Calendar Plugin up to 6.15.17 on WordPress ajax_create_import path traversal

A vulnerability was found in stellarwp Events Calendar Plugin up to 6.15.17 on WordPress. It has been classified as critical. This affects the function ajax_create_import. The manipulation leads to path traversal.

This vulnerability is uniquely identified as CVE-2026-3585. The attack is possible to be carried out remotely. No exploit exists.