CVE-2022-1453

CRITICAL EXPLOITED NUCLEI

RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection in rsvpmaker-util.php

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-1453 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.

Nuclei Templates (1)

RSVPMaker <= 9.2.5 - SQL Injection
CRITICALVERIFIEDby Shivam Kamboj

References (4)

Core 4

Scores

CVSS v3 9.8
EPSS 0.0691
EPSS Percentile 93.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2026-03-31
CWE
CWE-89
Status published
Products (2)
carrcommunications/rsvpmaker < 9.2.6
davidfcarr/RSVPMaker < 9.2.5
Published May 10, 2022
Tracked Since Feb 18, 2026