CVE-2026-57771
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The GD Rating System WordPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects all versions up to and including 3.7.
Risk Assessment
An attacker can exploit this vulnerability to read, modify, or delete data from the WordPress database, potentially leading to data theft or full site compromise.
Recommendation
Immediately update the GD Rating System plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.
Other vulnerabilities in GD Rating System
See all- CVE-2026-42639Critical
The GD Rating System versions up to 3.6.2 are vulnerable to unauthenticated SQL injection.
- CVE-2026-93430High
The GD Rating System plugin for WordPress is vulnerable to stored cross-site scripting via 'title' and 'url' render args in gdrts_live_handler AJAX in versions up to and including 3.7.1. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. Although the AJAX action requires a per-item nonce, that nonce is publicly emitted in the page's JSON block on every page rendering the rating item.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS