CVE-2026-42639: WordPress GD Rating System plugin <= 3.6.2 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the GD Rating System WordPress plugin at version 3.6.2 and below. The flaw is reachable over the network with no authentication required and no user interaction needed, allowing an attacker to send crafted requests directly to the affected endpoint. Successful exploitation gives an attacker read access to the underlying database contents and causes minor disruption to service availability. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP or HTTPS to send a malicious request.

• AuthenticationNot required

  No account or session credential of any kind is needed; the injection point is accessible to any anonymous HTTP client.

• Victim interactionNot required

  The attacker sends requests directly to the server; no user action such as clicking a link or visiting a page is required.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special preconditions, race conditions, or knowledge of environmental factors.

Blast Radius

• Reads arbitrary database rows, including WordPress user credentials (hashed passwords), email addresses, session tokens, and any data stored by other plugins or themes.
• The scope impact is changed (S:C), meaning data readable via the injection is not limited to the plugin's own tables but can span the entire database the WordPress user account has access to.
• Causes minor degradation of service availability through resource-intensive injected queries, which can slow or intermittently disrupt responses for legitimate users.