CVE WatchJul 24, 2026

CVE-2026-39536

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows R

CVSS

5.3

Medium

EPSS

0.2%

p15

KEV

—

Exploit Today

0-100

Published: Apr 8, 2026 · Last modified: Jul 24, 2026 · CWE-497

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-07-292026-08-26

Technical description

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2.7.16.

Official references

patchstack.comhttps://patchstack.com/database/Wordpress/Plugin/rsvp/vulnerability/wordpress-rsvp-and-event-management-plugin-2-7-16-sensitive-data-exposure-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-782687.5 HIG

16.2%

——5Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.2d CVE-2026-759285.3 MED

31.9%

——10The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.6d CVE-2026-672675.5 MED

1.0%

——0Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.6d CVE-2026-740075.3 MED

14.9%

——4Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions.7d CVE-2026-324687.5 HIG

22.4%

——7Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.7d CVE-2024-583757.5 HIG

16.7%

——5OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts.10d