What is the CVSS score of EUVD-2026-36815?

EUVD-2026-36815 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

GD Rating System EUVD-2026-36815

| CVE-2026-42639 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-3cvj-x7f9-wmv2

WordPress SQLi Wordpress Plugin Gd Rating System Dev4Press

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope changes to DB authority (S:C); read-only injection per source (C:H, I:N), with query-based A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Jun 22, 2026 - 06:03 cve.org

CRITICAL 9.3

Analysis Generated

Jun 15, 2026 - 22:02 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.

AnalysisAI

Unauthenticated SQL injection in the GD Rating System WordPress plugin (versions <= 3.6.2) allows remote attackers to inject arbitrary SQL queries against the WordPress database without any authentication or user interaction. The flaw carries a CVSS 3.1 score of 9.3 with scope change, indicating database tampering can affect resources beyond the plugin itself. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

GD Rating System is a WordPress plugin developed by Dev4Press (CPE: cpe:2.3:a:dev4press:gd_rating_system) that provides post and content rating functionality. The vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input is concatenated into SQL statements without proper parameterization or escaping. In WordPress plugin contexts, this typically arises in AJAX endpoints, REST routes, or front-end form handlers where rating IDs, post IDs, or filter parameters are passed directly to $wpdb queries. The CVSS scope change (S:C) signal indicates that successful exploitation impacts the underlying WordPress database - a security authority distinct from the plugin component itself.

RemediationAI

Patch status from the supplied data is ambiguous - no exact fix version is named in the input, so treat this as: patch availability not independently confirmed from provided references; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gd-rating-system/vulnerability/wordpress-gd-rating-system-plugin-3-6-2-sql-injection-vulnerability and the Dev4Press plugin page on wordpress.org for a version newer than 3.6.2. If a fixed release is unavailable, deactivate and remove the GD Rating System plugin (rating widgets will disappear from posts), or place the site behind a WAF with WordPress-aware SQLi signatures (Wordfence, Patchstack mu-plugin, Cloudflare Managed Ruleset) accepting that custom rating parameters may need allowlist tuning. As a stop-gap, restrict access to the plugin's AJAX/REST endpoints (typically under /wp-admin/admin-ajax.php with plugin-specific actions, or /wp-json/) via web server rules, understanding this may break legitimate front-end rating submissions.