CVE-2022-1505

CRITICAL

RSVPMaker <= 9.2.6 - Unauthenticated SQL Injection via rsvpmaker-api-endpoints.php

Title source: llm

Description

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6.

References (3)

Core 3

Core References

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2715095%40rsvpmaker&new=2715095%40rsvpmaker&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/6837b91d-b3ba-435a-965b-fa18d9b9b9c8?source=cve

Third Party Advisory

https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1505

Scores

CVSS v3 9.8

EPSS 0.0182

EPSS Percentile 76.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-89

Status published

Products (2)

carrcommunications/rsvpmaker < 9.2.7

davidfcarr/RSVPMaker < 9.2.6

Published May 10, 2022

Tracked Since Feb 18, 2026