Cyber Resilience

CVE-2022-1768

CriticalPublic PoC

Published: 13 June 2022

Published
13 June 2022
Modified
08 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.8613 99.4th percentile
Risk Priority 71 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-1768 is a critical-severity SQL Injection (CWE-89) vulnerability in Carrcommunications Rsvpmaker. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The RSVPMaker plugin for WordPress, up to and including version 9.3.2, contains an unauthenticated SQL injection vulnerability (CWE-89) in the rsvpmaker-email.php file. Insufficient escaping and parameterization of user-supplied input in multiple SQL queries allows direct manipulation of database statements. The issue carries a CVSS 3.1 score of 9.8 and is distinct from the related CVEs 2022-1453 and 2022-1505.

Unauthenticated remote attackers can exploit the flaw over the network without credentials or user interaction to extract arbitrary data from the WordPress database. Successful exploitation can also lead to modification or deletion of records, resulting in full compromise of confidentiality, integrity, and availability.

Wordfence and the official plugin changelog reference a fix committed in changeset 2725322 that updates the affected queries with proper parameterization. Administrators are advised to apply the patched version available through the WordPress plugin repository. Public exploit code has been posted to Packet Storm and a technical gist, while the EPSS score has reached a peak of 0.8613.

EU & UK References

Vulnerability details

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive…

more

information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.

CWE(s)
CWE-89

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

carrcommunications
rsvpmaker
≤ 9.3.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation
addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References