The GD Rating System plugin for WordPress contains a blind SQL injection flaw caused by improper neutralization of special characters in the SQL commands used by the plugin. An attacker can send specially crafted input through the plugin’s exposed front‑end interfaces, causing the plugin to incorporate the input directly into an SQL query without proper sanitization. This flaw can lead to the execution of arbitrary SQL statements, exposing, modifying, or deleting data stored in the WordPress database and potentially compromising the confidentiality, integrity, and availability of the site.

The vulnerability affects the GD Rating System plugin developed by Milan Petrovic and applies to all installed versions 3.7 or earlier, regardless of the WordPress core version, as the flaw resides entirely within the plugin code.

The CVSS score of 8.5 categorizes this issue as high severity, while the EPSS score of <1% suggests a low likelihood of active exploitation in the overall threat landscape. The vulnerability is not listed in C via the plugin’s public entry points. It is inferred that an attacker does not need prior authentication or elevated privileges to trigger this blind injection by submitting crafted parameters to the plugin’s front‑end endpoints.