CVE-2026-27398

MediumCVSS 5.3/10Last modified Jul 20, 2026

Description

Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects RSVP and Event Management: from n/a through 2.7.16.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
May 25, 2026
Last modified
Jul 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-273995.3Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.CVE-2026-27408.4Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulneraCVE-2026-274008.6Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.CVE-2026-274027.1Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.CVE-2026-274036.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSCVE-2026-274047.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.CVE-2026-274056.5Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. CVE-2026-274067.5Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.CVE-2026-274077.2Editor Privilege Escalation in AI Engine <= 3.4.9 versions.CVE-2026-274087.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch alCVE-2026-274095.3Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. CVE-2026-27416.8Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through
CVE-2026-27398: Medium severity, CVSS 5.3 | Vulnix