RSVP and Event Management CVE-2026-27398

The WP Chill RSVP and Event Management plugin version 2.7.16 or earlier must be installed and active on a WordPress site. The CVSS vector (PR:N/UI:N) confirms no authentication and no user interaction are required - exploitation targets any publicly reachable WordPress installation running the plugin. Exploitation is bounded by the partial integrity-only impact (I:L, C:N, A:N): attackers can write or modify data within the plugin's scope but cannot read sensitive data or disrupt service availability. No specific non-default configuration is required to be vulnerable; the flaw exists in the plugin's standard access control implementation. Limiting factors include the narrow impact scope and the requirement that the specific plugin be installed and active.

CVSS 5.3 Medium reflects easy, unauthenticated network access but a narrow blast radius - only partial integrity impact, with confidentiality and availability unaffected (C:N/A:N). EPSS at 0.03% (8th percentile) is notably low, indicating the security community sees very little real-world exploitation probability. SSVC corroborates: exploitation status is 'none' currently, though the automatable flag is significant - once a script exists, bulk scanning of WordPress sites for this plugin is trivial. The vulnerability is not listed in CISA KEV. No POC has been identified. The overall real-world risk is low-to-moderate: the attack surface is wide (any public WordPress site running the plugin), but the achievable impact is narrow, and there is no current evidence of active or targeted exploitation.

An unauthenticated attacker scans for WordPress sites with the RSVP and Event Management plugin installed and sends a crafted HTTP POST request to the plugin's AJAX or REST endpoint, invoking a privileged action without any session cookie or nonce tied to an authorized user. The missing authorization check allows the request to proceed, enabling the attacker to tamper with event records or RSVP entries - for example, bulk-accepting or canceling RSVPs for an event. No public POC is currently known, but the low attack complexity and automatable SSVC rating mean this is scriptable at scale.