/Vulnerability Library

RSVPMaker <= 9.2.5 - SQL Injection

CVE-2022-1453
Verified

Description

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.

Severity

Critical

CVSS Score

9.8

Exploit Probability

7%

Published Date

February 22, 2026

Template Author

shivam kamboj

CVE-2022-1453.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2022-1453
CWE ID:
cwe-89

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/rsvpmaker/rsvpmaker-925-unauthenticated-sql-injectionhttps://nvd.nist.gov/vuln/detail/CVE-2022-1453

Remediation Steps

Update to version 9.2.6, or later