WordPress RSVPMarker Plugin < 10.5.5 is vulnerable to SQL Injection

Vulnerability

An authenticated SQL injection vulnerability exists in the RSVPMaker plugin for WordPress, affecting all versions prior to 10.5.5. The flaw is present in the plugin's database query logic, requiring admin-level privileges to reach the vulnerable code path. [1]

Exploitation

An attacker must have an admin account (admin+) on the WordPress instance to exploit this vulnerability. No other prerequisites are mentioned in the available references. The attacker would then craft a malicious SQL payload within a plugin input field to inject unauthorized database commands. The exact injection vector and steps are not further detailed in the references. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary SQL queries on the underlying database. This can lead to disclosure of sensitive information, modification or deletion of data, and potentially privilege escalation within the WordPress application depending on the scope of the database account. [1]

Mitigation

Users should update the RSVPMaker plugin to version 10.5.5 or later, which contains the fix. No workarounds are documented, and the plugin does not appear on CISA's KEV list. [1]