The Events Calendar Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in The Events Calendar plugin for WordPress, affecting all versions through 6.15.17. The vulnerability arises in the 'ajax_create_import' function, where authenticated attackers with Author-level access or higher can exploit the issue to read arbitrary files on the server. This could lead to the exposure of sensitive information.

Impact

Exploitation of this vulnerability allows for arbitrary file read on the server, which can be used to access sensitive information.

Remediation

Users can update to version 6.15.17.1 or a newer patched version to address this vulnerability.