Read the docs
TI-2022-00951 Aliases CVE-2022-1054GHSA-j4p9-r4c6-88m5

RSVP and Event Management < 2.7.8 - Unauthenticated Entries Export

Priority LOW 31CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events

Why it matters now

EPSS 0.04213 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed RSVP and Event Management Plugin (Unknown): 2.7.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownRSVP and Event Management Plugin2.7.2 and later; 2.7.8 to before 2.7.82.7.8Patch availableCNA
  • RSVP and Event Management Plugin VendorUnknown Affected 2.7.2 and later; 2.7.8 to before 2.7.8 Fixed in 2.7.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpchill:rsvp_and_event_management:*:*:*:*:*:wordpress:*:*before 2.7.8Vulnerablewpchill
  • cpe:2.3:a:wpchill:rsvp_and_event_management:*:*:*:*:*:wordpress:*:* Versions before 2.7.8 Vulnerable ·wpchill

Remediation

  • Fix · CNA RSVP and Event Management Plugin (Unknown) Fixed in 2.7.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1054
  2. 2026-10-03 Alias added: GHSA-j4p9-r4c6-88m5

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences