This vulnerability in WP Chill RSVP and Event Management plugin (versions <= 2.7.14) allows SQL Injection due to improper neutralization of special elements in SQL commands. The CVSS 3.1 vector indicates the attack requires network access, low attack complexity, and high privileges, with no user interaction needed. The impact is primarily on confidentiality with limited impact on availability and no impact on integrity. No official patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation could allow an attacker with high privileges to execute crafted SQL commands that may expose sensitive data from the database, impacting confidentiality. The vulnerability does not affect data integrity but could cause limited availability impact. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's administrative functions to trusted users only and monitor for unusual database activity related to the plugin. Avoid exposing the affected plugin to untrusted networks or users with high privileges.