Critical severity9.8NVD Advisory· Published Jun 13, 2022· Updated Apr 8, 2026
CVE-2022-1768
CVE-2022-1768
Description
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2.
Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.
Affected products
1- cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*Range: <=9.3.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02ccnvdExploitThird Party Advisory
- plugins.trac.wordpress.org/changesetnvdExploitThird Party Advisory
- www.wordfence.com/vulnerability-advisories/nvdThird Party Advisory
- packetstormsecurity.com/files/176549/WordPress-RSVPMaker-9.3.2-SQL-Injection.htmlnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1fnvd
News mentions
0No linked articles in our index yet.