blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2022-1768

HIGH 7.5 CVSS 3.1
Published
June 13, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-89
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • davidfcarr RSVPMaker — Up to and including 9.3.2
  • carrcommunications rsvpmaker — Up to and including 9.3.2

References

  • gist.github.com https://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02cc Exploit, Third Party Advisory
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail= Exploit, Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1f?source=cve
  • www.wordfence.com https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1768 Third Party Advisory
  • packetstormsecurity.com http://packetstormsecurity.com/files/176549/WordPress-RSVPMaker-9.3.2-SQL-Injection.html
  • nvd.nist.gov Official NVD record