CVE-2026-57771

Name of the Vulnerable Software and Affected Versions GD Rating System versions prior to 3.8

Description An SQL Injection issue exists in the GD Rating System plugin for WordPress. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation of the SQL query. Authenticated attackers with contributor-level access or higher can append additional SQL queries to existing ones to extract sensitive information from the database. This specific type of flaw is a Blind SQL Injection, where the attacker cannot see the direct output of the query but can infer data based on the application's response.

Recommendations Update GD Rating System to a version newer than 3.7.