CVE-2026-57771

HighCVSS 8.5

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

The GD Rating System WordPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects all versions up to and including 3.7.

Risk Assessment

An attacker can exploit this vulnerability to read, modify, or delete data from the WordPress database, potentially leading to data theft or full site compromise.

Recommendation

Immediately update the GD Rating System plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.

Other vulnerabilities in GD Rating System

CVE-2026-42639Critical
The GD Rating System versions up to 3.6.2 are vulnerable to unauthenticated SQL injection.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.