The vulnerability is a missing authorization flaw in the WP Chill RSVP and Event Management plugin for WordPress, affecting all releases up to and including version 2.7.16. Because the plugin’s access control levels are improperly configured, a user with any authenticated WordPress role may be able to view, edit, or delete event and RSVP records, resulting in confidentiality and integrity loss for the data managed by the plugin.

The affected vendor is WP Chill and the product is the RSVP and Event Management plugin. All plugin releases from the earliest available version through 2.7.16 are susceptible, with the latest unpatched version being 2.7.16.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that large‑scale exploitation has not been reported. Based on the description, the attack likely requires a logged‑in user; an attacker could exploit incorrectly configured access control levels to elevate permissions and manipulate event data.