What is the CVSS score of CVE-2026-57771?

CVE-2026-57771 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of GD Rating System are affected by CVE-2026-57771?

The GD Rating System WordPress plugin (versions 3.7 and earlier) contains a blind SQL injection vulnerability allowing authenticated users to extract sensitive database contents.

How to fix or mitigate CVE-2026-57771?

Within 24 hours, identify all WordPress installations using GD Rating System versions 3.7 and below and audit database query logs for suspicious SQL patterns. Within 7 days, restrict plugin access to trusted administrators only, implement Web Application Firewall rules to block SQL injection patterns targeting the plugin, and disable the plugin if functionality is not business-critical. Within 30 days, evaluate alternative rating plugins for migration and establish a process to upgrade immediately once the vendor releases a patched version.

GD Rating System CVE-2026-57771

EUVD-2026-43391 HIGH

SQL Injection (CWE-89)

2026-07-13 Patchstack

WordPress SQLi Wordpress Plugin Gd Rating System

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.1 HIGH

Network-reachable SQLi needing a low-privilege account (PR:L, AC:L); high confidentiality via data extraction, limited integrity from possible write, and no scope change since impact stays within the database.

3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:36 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Rating System gd-rating-system allows Blind SQL Injection.This issue affects GD Rating System: from n/a through <= 3.7.

AnalysisAI

Blind SQL injection in the GD Rating System WordPress plugin (versions up to and including 3.7) allows authenticated attackers to inject arbitrary SQL into backend database queries. Because the CVSS vector shows PR:L, a low-privileged authenticated user can extract sensitive database contents (CVSS 8.5, scope-changed). No public exploit identified at time of analysis; the flaw was reported by Patchstack via its coordinated disclosure database.

Technical ContextAI

The affected component is GD Rating System, a WordPress rating plugin authored by Milan Petrovic (CPE cpe:2.3:a:milan_petrovic:gd_rating_system). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into a SQL statement without proper parameterization or escaping before being passed to the WordPress database layer (wpdb/MySQL). It is characterized specifically as a blind SQL injection, indicating the query results are not returned directly in the response, so an attacker infers data via boolean or time-based conditional responses rather than direct error/UNION output.

RemediationAI

No vendor-released patch version was identified at time of analysis; the input only confirms all versions up to and including 3.7 are affected. Update GD Rating System to any release later than 3.7 if and when the vendor publishes one, and consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/gd-rating-system/vulnerability/wordpress-gd-rating-system-plugin-3-7-sql-injection-vulnerability?_s_id=cve) for the fixed version. Until a fix is confirmed, apply specific compensating controls: place a WAF or Patchstack virtual patch in front of the site to filter SQL injection payloads (trade-off: signature gaps may miss obfuscated blind payloads); tighten user registration and revoke unnecessary low-privilege accounts to remove the PR:L foothold (trade-off: disables self-service signup); and restrict access to the plugin's rating endpoints/AJAX actions by IP or authentication where feasible (trade-off: may break legitimate rating submission features).