This vulnerability in WP Chill RSVP and Event Management plugin allows exposure of sensitive system information to unauthorized actors. It affects all versions up to and including 2.7.16. The issue enables an attacker with network access and no privileges to retrieve embedded sensitive data, potentially aiding further attacks. The CVSS vector indicates low complexity and no user interaction required, but only confidentiality impact is noted without integrity or availability impact.

An attacker can obtain sensitive system information without authentication, which may facilitate further reconnaissance or targeted attacks. The confidentiality impact is limited, with no direct integrity or availability consequences reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor channels for updates and consider restricting access to the affected plugin functionality if possible.