CVE-2026-15439: GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection

In plain English

A medium-severity SQL injection in GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI from rubengc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Official description

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.

Vendor	Product	Versions
rubengc	GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI	0 – through 7.9.7

Vendor

Product

Versions

rubengc

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI

0 – through 7.9.7

CVE-2026-15439GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection

In plain English

Official description

Affected products (as reported)

References