An SQL Injection vulnerability exists in the WordPress RSVP and Event Management plugin (WP Chill) versions 2.7.14 and prior. The flaw allows an attacker to embed and execute arbitrary SQL statements against the underlying database. This can lead to unauthorized data read, modification or deletion, compromising the confidentiality and integrity of the site’s data. The vulnerability is classified as CWE-89.

WordPress installations that use the WP Chill RSVP and Event Management plugin version 2.7.14 or older are affected. Sites should verify the plugin version and apply an upgrade if necessary.

The CVSS score of 7.6 indicates moderate to high severity. The EPSS score of <1% suggests a low probability of exploitation at the moment, and the issue is not listed in CISA KEV. The likely attack vector is web‑based, where an attacker submits crafted input via the plugin’s forms or APIs, exploiting the lack of proper input sanitization. Exploitation would require the attacker to identify a reachable input field and provide malicious SQL code, which the plugin would then execute against the database.