CVE-2022-1768

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.

• CWE-89

• https://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02ccExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail=Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1f?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1768Third Party Advisory
• http://packetstormsecurity.com/files/176549/WordPress-RSVPMaker-9.3.2-SQL-Injection.html
• https://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02ccExploit, Third Party Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail=Exploit, Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1f?source=cve
• https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1768Third Party Advisory

Published

Jun 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1762The iQ Block Country WordPress plugin before 1.2.20 does not…7.5
• CVE-2022-1763Due to missing checks the Static Page eXtended WordPress plu…5.4
• CVE-2022-1764The WP-chgFontSize WordPress plugin through 1.8 does not hav…5.4
• CVE-2022-1765The Hot Linked Image Cacher WordPress plugin through 1.16 is…8.8
• CVE-2022-1766Anchore Enterprise anchorectl version 0.1.4 improperly store…7.5
• CVE-2022-1767Server-Side Request Forgery (SSRF) in GitHub repository jgra…7.5
• CVE-2022-1769Buffer Over-read in GitHub repository vim/vim prior to 8.2.4…7.8
• CVE-2022-1770Improper Privilege Management in GitHub repository polonel/t…8.8
• CVE-2022-1771Uncontrolled Recursion in GitHub repository vim/vim prior to…5.5
• CVE-2022-1772The Google Places Reviews WordPress plugin before 2.0.0 does…4.8
• CVE-2022-1773The WP Athletics WordPress plugin through 1.1.7 does not san…6.1
• CVE-2022-1774Exposure of Sensitive Information to an Unauthorized Actor i…6.1