First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-27398

MediumCVSS 5.3/10Last modified Jul 20, 2026

Description

Missing Authorization vulnerability in WP Chill RSVP and Event Management allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects RSVP and Event Management: from n/a through 2.7.16.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
WP Chill	RSVP and Event Management	<= 2.7.16

References

https://patchstack.com/database/wordpress/plugin/rsvp/vulnerability/wordpress-rsvp-and-event-management-plugin-2-7-16-broken-access-control-vulnerability?_s_id=cve

Timeline

Published: May 25, 2026
Last modified: Jul 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-273995.3Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.CVE-2026-27408.4Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnera CVE-2026-274008.6Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.CVE-2026-274015.3Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows CVE-2026-274027.1Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.CVE-2026-274036.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XS CVE-2026-274047.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.CVE-2026-274056.5Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. CVE-2026-274067.5Insertion of Sensitive Information Into Sent Data vulnerability in Joe Dolson My Tickets my-tickets allows Retrieve Embedded Sensitive Data.CVE-2026-274077.2Editor Privilege Escalation in AI Engine <= 3.4.9 versions.CVE-2026-274087.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch al CVE-2026-274095.3Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels.

CVE-2026-27398: Medium severity, CVSS 5.3 | Vulnix