CVE-2026-27398

MediumCVSS 5.3

Published: 25/05/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The RSVP and Event Management plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 2.7.16.

Risk Assessment

The organization is at risk of unauthorized access to event management functions, potentially leading to privilege escalation and data integrity compromise.

Recommendation

It is recommended to immediately update the RSVP and Event Management plugin to the latest available version that addresses this vulnerability.

Other vulnerabilities in RSVP and Event Management

CVE-2026-39536Medium
The WordPress plugin RSVP and Event Management (rsvp) by WP Chill has a vulnerability that exposes sensitive system information to unauthorized control spheres, allowing retrieval of embedded sensitive data. This affects versions up to and including 2.7.16.

Original NVD description (English source)

Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RSVP and Event Management: from n/a through 2.7.16.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS