CVE-2024-12711 describes a missing authorization vulnerability in the RSVP and Event Management WordPress plugin by wpchill. Several AJAX functions, including bulk_delete_attendees() and bulk_delete_questions(), do not perform capability checks, enabling unauthenticated attackers to delete event questions and attendees. Authenticated users can modify question menu orders without proper authorization. This affects all versions up to and including 2.7.13. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows unauthenticated attackers to delete event-related data such as questions and attendees, which can disrupt event management functionality. Authenticated users can reorder questions without proper authorization, potentially affecting event presentation or data integrity. There is no confidentiality or availability impact reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin's AJAX endpoints where possible and monitor for suspicious activity related to event data deletion or modification. Avoid using versions up to 2.7.13 in production environments if possible.