CVE-2024-12711: The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like…

PriorityP429medium5.3CVSS 3.1

AVNACLPRNUINSUCNILAN

EPSS

0.33%

24.2th percentile

The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulk_delete_attendees() and bulk_delete_questions() in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers to delete questions and attendees and for authenticated users to update question menu orders.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
wpchill	rsvp_and_event_management	<= 2.7.13	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.