Rsvp And Event Management CVE-2026-39536

The plugin must be installed and activated on a WordPress site with default network accessibility. An unprotected endpoint or REST API route that returns sensitive data without proper capability checks or authentication must be publicly accessible. No special WordPress configuration, user interaction, or authentication is required to trigger the vulnerability; any visitor capable of reaching the WordPress site can exploit it.

Despite a moderate CVSS score of 5.3 (reflecting network accessibility and low attack complexity), multiple signals indicate low real-world exploitability. The EPSS score of 0.02% (5th percentile) suggests minimal economic incentive or proven exploitation patterns in the wild. The vulnerability requires no authentication (PR:N) but only discloses information (C:L; no integrity or availability impact), limiting an attacker's ability to pivot to higher-impact attacks. No CISA KEV status or public exploit code is referenced, indicating this is a low-priority disclosure without active weaponization. The attack vector is network-based with low complexity, making it theoretically accessible, but the information exposure alone does not enable immediate system compromise. Organizations should prioritize patching only if sensitive data exposure correlates with business risk (e.g., exposure of user PII or API keys in RSVP data).

An unauthenticated remote attacker sends an HTTP request to an unprotected endpoint in the RSVP and Event Management plugin to retrieve embedded sensitive data such as event details, attendee information, or internal configuration metadata. The attacker requires no special privileges or user interaction and can automate this data collection across multiple targets to build a profile of vulnerable WordPress sites and harvest exposed information.