CVE-2022-1453
Published: 10 May 2022
Summary
CVE-2022-1453 is a critical-severity SQL Injection (CWE-89) vulnerability in Carrcommunications Rsvpmaker. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The RSVPMaker plugin for WordPress is affected by an unauthenticated SQL injection vulnerability (CWE-89) present in versions up to and including 9.2.5. The flaw stems from missing SQL escaping and parameterization of user-supplied input passed to queries in the rsvpmaker-util.php file, allowing direct manipulation of database statements.
Unauthenticated remote attackers can exploit the issue over the network without any credentials or user interaction. Successful exploitation enables theft of sensitive database contents and carries a CVSS 3.1 score of 9.8, reflecting full impact on confidentiality, integrity, and availability.
Public references point to a fix committed in the plugin repository and a corresponding WordPress plugin changeset; administrators are advised to apply the available update to eliminate the vulnerable code paths. The EPSS score reached a peak of 0.6993 with a current value of 0.6074, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-24759
Vulnerability details
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal…
more
sensitive information from the database in versions up to and including 9.2.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.