An SQL Injection flaw exists in the RSVPMarker WordPress plugin up to version 11.6.7. The plugin fails to properly escape special characters before including user‑supplied data in SQL commands. The flaw can be exploited to run arbitrary SQL queries against the site’s database. Successful exploitation could allow an attacker to read sensitive information, modify content, or potentially gain deeper database privileges.

WordPress sites using the RSVPMarker plugin from any released version up to and including 11.6.7 are affected. The vendor is davidfcarr and the product is RSVPMarker. No additional product or operating system details are provided. Users should verify whether the plugin is installed and its version.

The CVSS base score is 9.3, indicating critical severity. The EPSS score for this vulnerability is currently below 1 %, suggesting that exploitation is unlikely but still possible. It is not listed in the CISA KEV catalog. The attack vector is remote: a malicious actor can trigger the injection by issuing crafted requests to the plugin’s web interface from any location with network access to the WordPress site. No authentication or privilege escalation is required beyond having access to the site’s publicly exposed plugin endpoints.