The GD Rating System plugin for WordPress, versions up to 3.6.2, contains an unauthenticated SQL Injection flaw that allows an attacker who does not need to be logged in to supply specially crafted input to the plugin’s rating interface. The vulnerability can be leveraged to read, modify, or delete data stored in the WordPress database, thereby compromising site integrity and confidentiality. The known CWE for this issue is CWE-89, indicating a classic injection flaw where unchecked input reaches a database query.

The affected system is the Dev4Press GD Rating System plugin for WordPress. All installations using version 3.6.2 or earlier are vulnerable, while newer releases mitigate the flaw.

The CVSS score of 9.3 classifies the vulnerability as critically high, and the EPSS score of less than 1 percent indicates a low exploitation probability at the time of this analysis. Because the vulnerability does not require authentication, any WordPress site that installs the GD Rating System can be targeted remotely. The fact that this vulnerability is not listed in the CISA KEV catalog suggests there are no confirmed exploits yet, but the high severity and wide deployment of the plugin necessitate immediate action.