CVE-2026-42639
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The GD Rating System versions up to 3.6.2 are vulnerable to unauthenticated SQL injection.
Risk Assessment
An attacker could exploit this vulnerability to gain access to sensitive data in the database, potentially leading to serious security breaches.
Recommendation
It is recommended to update the GD Rating System to the latest version to mitigate this vulnerability.
Other vulnerabilities in GD Rating System
See all- CVE-2026-93430High
The GD Rating System plugin for WordPress is vulnerable to stored cross-site scripting via 'title' and 'url' render args in gdrts_live_handler AJAX in versions up to and including 3.7.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's JSON block on every page rendering the rating item.
- CVE-2026-57771High
The GD Rating System WordPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects all versions up to and including 3.7.
Original NVD description (English source)
Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS