github.com
https://github.com/davidfcarr/rsvpmaker/commit/bfb189f49af7ab0d34499a2da772e3266f72167d CVE-2022-1453
CRITICALNuclei
RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection
Record summary
CVE-2022-1453 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.
Description
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Mar 31, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
| VulnCheck | Version data not supplied | ||
RSVPMakerBrowse davidfcarr / RSVPMakerDefault status: unaffected | CVE List | Through 9.2.5 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALRSVPMaker <= 9.2.5 - SQL InjectionCVSS 9.8
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
Impact
Attackers can retrieve sensitive data from the database without authentication, leading to data breach and privacy violations.
Remediation
Update to version 9.2.6, or later
WeaknessesCWE-89
AuthorsShivam Kamboj
Template tagscvecve2022wordpresswpwp-pluginsqlirsvpmakervkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/rsvpmaker/rsvpmaker-925-unauthenticated-sql-injection https://nvd.nist.gov/vuln/detail/CVE-2022-1453
Source: ProjectDiscovery
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-1453 plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2714389%40rsvpmaker&new=2714389%40rsvpmaker&sfp_email=&sfph_mail= wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/6031edec-4274-4e42-9e3a-ce0c94958b17?source=cve wordfence.com
https://www.wordfence.com/vulnerability-advisories