CVE-2026-39536
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress plugin RSVP and Event Management (rsvp) by WP Chill has a vulnerability that exposes sensitive system information to unauthorized control spheres, allowing retrieval of embedded sensitive data. This affects versions up to and including 2.7.16.
Risk Assessment
An attacker may gain access to sensitive system data such as server configuration or credentials, potentially facilitating further attacks.
Recommendation
Update the RSVP and Event Management plugin to a version above 2.7.16 if a patch is available, or restrict access to sensitive information.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.