Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2022-1453: RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection
CVE-2022-1453 · published 4 years ago
Summary
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the ...
What to do
- Update carrcommunications rsvpmaker to version 9.2.6 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| carrcommunications | rsvpmaker |
< 9.2.6 cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:* |
Original advisory text
RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
References
- https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1453 Vendor Advisory
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old... URL
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6031edec-4274-4e42-9e3... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1453.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-1453 Vendor Advisory
- https://github.com/davidfcarr/rsvpmaker/commit/bfb189f49af7ab0d34499a2da772e3266... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-89SQL Injection
Timeline
Published10 May 2022
Updated4 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta