{"id":"CVE-2026-15439","title":"GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection","summary":"The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-89"],"vendor":"rubengc","product":"GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI","affected":["gamipress_gamification_plugin_to_reward_points_badges_ranks_in_wordpress_now_with_ai <= 7.9.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-11T17:53:03.846559Z"},"published":"2026-09-11","updated":"2026-09-11","sourceUpdated":"2026-09-11T17:53:11.894Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-15439","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/72ad7420-5793-496e-8607-2b346c7a3ce5?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.3/integrations/wpforo/includes/functions.php#L40"},{"url":"https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.3/integrations/wpforo/includes/functions.php#L24"}],"tags":["cve.org"],"epss":0.00241,"epssPercentile":0.15477,"ingestedAt":"2026-09-14T00:35:28.535Z","slug":"CVE-2026-15439","body":"## Overview\n\nThe GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\\' -> \\\\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.\n\n## Affected\n\n- `gamipress_gamification_plugin_to_reward_points_badges_ranks_in_wordpress_now_with_ai <= 7.9.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}