The vulnerability in the WP Chill RSVP and Event Management plugin permits an unauthorized user to retrieve embedded sensitive data, exposing system information and compromising confidentiality. It originates from an improper handling of data within the plugin and is classified as CWE‑497, which denotes an improper constraint on the scope of a function leading to unintended information disclosure.

The affected product is the WP Chill RSVP and Event Management WordPress plugin, versions from the earliest release through 2.7.16 inclusive. No other vendors or products are listed as impacted.

With a CVSS score of 5.3 the risk is moderate; the EPSS score is under 1% and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path involves crafting a request that exploits the plugin’s data retrieval functionality, but explicit attack vectors are not detailed in the description. Overall, the exploitability is considered low to moderate, yet the impact on sensitive data warrants timely remediation.