CVE-2023-41652
Published: 03 November 2023
Summary
CVE-2023-41652 is a high-severity SQL Injection (CWE-89) vulnerability in Carrcommunications Rsvpmaker. Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 12.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-41652 is an SQL injection vulnerability arising from improper neutralization of special elements in SQL commands, present in the RSVPMaker WordPress plugin developed by David F. Carr. The flaw affects all versions through 10.6.6 and is tracked under CWE-89, carrying a CVSS 3.1 score of 8.2 that reflects network-accessible exploitation with low attack complexity.
Unauthenticated remote attackers can supply crafted input to trigger the injection, enabling extraction of sensitive data from the database along with limited impact on availability. No user interaction or privileges are required for successful exploitation.
Public references hosted by Patchstack document the vulnerability but do not detail specific patch contents or mitigation steps beyond version updates. The associated EPSS score rose from low values to a peak of 0.0613 before receding to the current 0.0314, indicating modest post-disclosure interest that has since declined.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46144
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.This issue affects RSVPMaker: from n/a through 10.6.6.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.