The RSVPMaker plugin for WordPress is vulnerable to...
High severity
Unreviewed
Published
Jun 14, 2022
to the GitHub Advisory Database
•
Updated Jan 15, 2024
Description
Published by the National Vulnerability Database
Jun 13, 2022
Published to the GitHub Advisory Database
Jun 14, 2022
Last updated
Jan 15, 2024
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.
References