Is CVE-2026-39536 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39536 being exploited in the wild.

How severe is CVE-2026-39536?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

WP Chill RSVP and Event Management <= 2.7.16.

Is there a fix for CVE-2026-39536?

A patch was published on 2026-04-08: Patch available in version 2.7.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39536 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39536?

Check whether you run WP Chill RSVP and Event Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39536: WP Chill RSVP and Event Management sensitive data exposure

Q: Is there a fix for CVE-2026-39536?

A patch was published on 2026-04-08: Patch available in version 2.7.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39536 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-39536?

Check whether you run WP Chill RSVP and Event Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39536 · Severity: medium · CVSS 5.3 · Published 2026-04-08

The RSVP and Event Management plugin for WordPress, which is used to manage event registrations and attendee lists, contains a security flaw that exposes sensitive system information. An unauthorized person could access data that is normally hidden, potentially revealing details about the website's configuration or user information. This exposure could be used by attackers to plan more sophisticated attacks against the site.

Technologies: WP Chill RSVP and Event Management. Vendors: WP Chill.

Quick answers

Is CVE-2026-39536 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39536 being exploited in the wild.
How severe is CVE-2026-39536?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: WP Chill RSVP and Event Management <= 2.7.16.
Is there a fix for CVE-2026-39536?: A patch was published on 2026-04-08: Patch available in version 2.7.17 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39536 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39536?: Check whether you run WP Chill RSVP and Event Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP Chill RSVP and Event Management plugin for WordPress (versions <= 2.7.16) is vulnerable to CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. This vulnerability allows an unauthenticated remote attacker to retrieve embedded sensitive data from the system. The flaw exists because the plugin does not properly restrict access to certain internal information or debug data within its control sphere. Attackers can exploit this over the network without any user interaction. A patch is available in version 2.7.17.

Affected products

WP Chill RSVP and Event Management <= 2.7.16

Timeline

2026-02-10: other: Vulnerability reported by researcher
2026-03-12: disclosed: Initial disclosure by Patchstack
2026-04-08: advisory: NVD publication date
2026-04-08: patched: Patch available in version 2.7.17

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.