CVE-2026-112837
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The GamiPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker can inject their own queries into the database.
Risk Assessment
An attacker can extract data from the database, including user data and credentials, and in some configurations modify or delete data. The blind nature makes detection harder but still allows information exfiltration.
Recommendation
Update the GamiPress plugin to a version later than 8.0.7. Verify database integrity and review logs for suspicious queries.
Other vulnerabilities in GamiPress
See all- CVE-2026-59538Critical
The GamiPress plugin for WordPress version 7.9.7 and earlier contains an unauthenticated SQL injection vulnerability.
- CVE-2026-94177High
The GamiPress plugin is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in SQL commands. This affects versions from n/a through 8.0.2.
- CVE-2026-15439Medium
The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder, allowing the attacker to break out of the string and inject boolean-based SQL.
- CVE-2026-16091Medium
The GamiPress plugin for WordPress up to version 7.9.9.1 contains a Stored Cross-Site Scripting (XSS) vulnerability via the 'gamipress_rank' shortcode. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute whenever a user accesses an injected page.
- CVE-2026-16090Medium
The GamiPress plugin for WordPress is vulnerable to stored XSS via the 'heading_size' shortcode attribute in 'gamipress_achievement'. Attackers with contributor-level access can inject arbitrary scripts that execute when a user visits the page.
- CVE-2026-13450Medium
The GamiPress plugin for WordPress up to version 7.9.4 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'access' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can view private GamiPress activity logs, including badge earnings, points balance changes, and events from integrated plugins like WooCommerce, LearnDash, and BuddyPress.
- CVE-2026-48874High
GamiPress versions up to 7.8.7 contain a SQL Injection vulnerability that can be exploited by subscribers.
- CVE-2026-24546Medium
Missing authorization in the GamiPress plugin allows exploiting incorrectly configured access control security levels. The vulnerability affects versions from n/a through 7.6.3.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS