---
id: CVE-2026-15439
title: GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
summary: >-
  The GamiPress plugin for WordPress is vulnerable to authenticated
  (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration
  AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and
  including, 7.9.7. The …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: rubengc
product: >-
  GamiPress – Gamification plugin to reward points, badges & ranks in WordPress,
  now with AI
affected:
  - >-
    gamipress_gamification_plugin_to_reward_points_badges_ranks_in_wordpress_now_with_ai
    <= 7.9.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-11T17:53:03.846559Z'
published: '2026-09-11'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T17:53:11.894Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-15439'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/72ad7420-5793-496e-8607-2b346c7a3ce5?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.3/integrations/wpforo/includes/functions.php#L40
  - url: >-
      https://plugins.trac.wordpress.org/browser/gamipress/tags/7.9.3/integrations/wpforo/includes/functions.php#L24
tags:
  - cve.org
epss: 0.00234
epssPercentile: 0.12839
ingestedAt: '2026-09-14T00:35:28.535Z'
---

## Overview

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.

## Affected

- `gamipress_gamification_plugin_to_reward_points_badges_ranks_in_wordpress_now_with_ai <= 7.9.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.