Critical severity9.8NVD Advisory· Published May 10, 2022· Updated Apr 8, 2026

CVE-2022-1453

Description

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Carrcommunications/Rsvpmaker
cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*
Range: <9.2.6
WordPress/Rsvpmakerllm-fuzzy
Range: <=9.2.5
Package: https://wordpress.org/plugins/rsvpmaker

Patches

Vulnerability mechanics

References

github.com/davidfcarr/rsvpmaker/commit/bfb189f49af7ab0d34499a2da772e3266f72167dnvdPatch
plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/6031edec-4274-4e42-9e3a-ce0c94958b17nvdThird Party Advisory
www.wordfence.com/vulnerability-advisories/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.006
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000