CVE-2022-1453

    Dashboard / Vulnerabilities / CVE-2022-1453

    CVE-2022-1453

    Published: 10 May 2022Last Modified: 12 Aug 2026

    Summary: RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection

    Details: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.

    References: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2714389%40rsvpmaker&new=2714389%40rsvpmaker&sfp_email=&sfph_mail=, https://www.wordfence.com/threat-intel/vulnerabilities/id/6031edec-4274-4e42-9e3a-ce0c94958b17?source=cve, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1453.json, https://nvd.nist.gov/vuln/detail/CVE-2022-1453, https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1453, https://github.com/davidfcarr/rsvpmaker/commit/bfb189f49af7ab0d34499a2da772e3266f72167d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -bfb189f49af7ab0d34499a2da772e3266f72167d

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-1453 | CVE-DB