Description

The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-11T16:17:05.597Z",
  "pubdate": "2026-09-11T16:17:05.597Z",
  "executiveSummary": "GamiPress versions up to and including 7.9.7 are susceptible to an authenticated SQL injection vulnerability via the wpForo integration.\nThe vulnerability originates in the 'gamipress_wpforo_get_posts' AJAX action, specifically within the handling of the 'q' parameter.\nBy manipulating the 'q' parameter, a Subscriber-level user can break out of a single-quoted SQL string context, enabling boolean-based blind SQL injection.\nThe flaw stems from improper sanitization where input is processed by $wpdb->esc_like() without the protection of $wpdb->prepare() or adequate placeholders.\nSuccessful exploitation allows an attacker to interact with the underlying WordPress database, potentially leading to unauthorized data exfiltration.\nPrerequisites include a Subscriber-level account and the acquisition of the 'gamipress_admin' nonce, which is discoverable via standard WordPress administrative interfaces.\nThis vulnerability highlights a critical breakdown in data-to-query binding practices when integrating third-party components like wpForo.",
  "technicalDetails": "The vulnerability resides in the 'gamipress_wpforo_get_posts' AJAX endpoint, which serves as a callback when the wpForo plugin is active. The root cause is the insecure handling of the user-supplied 'q' parameter.\nIn the affected versions, the 'q' parameter is passed through the $wpdb->esc_like() function but is subsequently concatenated directly into a SQL query string containing a LIKE clause. The SQL query structure fails to utilize the $wpdb->prepare() method with proper %s placeholders, leaving the input string unparameterized.\nThe exploitation mechanism relies on the interaction between $wpdb->esc_like() and WordPress core magic quotes. When an attacker provides a payload containing a backslash, the system processes it in a way that generates a literal backslash followed by a closing single quote (\\'). Because the input is not correctly wrapped in a parameterized query, this closing quote terminates the intended string literal prematurely.\nThis behavior allows the attacker to break out of the string boundary and inject arbitrary SQL logic into the query. By appending boolean operators, an attacker can perform blind SQL injection, determining the structure of the database or sensitive information stored within it by observing the responses of the application.\nThe attack flow requires the attacker to first obtain the 'gamipress_admin' nonce. Since this nonce is exposed on various admin pages, such as the user profile (/wp-admin/profile.php), it is accessible to any user with Subscriber-level privileges.\nOnce the nonce is acquired, the attacker submits a crafted POST request to the WordPress admin-ajax.php endpoint. The payload injected into the 'q' parameter bypasses the weak character escaping to manipulate the database query. Because the wpForo integration registers this callback whenever the plugin is active, the vulnerability remains accessible as long as both GamiPress and wpForo are enabled. The lack of secondary validation or parameterized binding ensures that the injected boolean logic is executed by the database engine, leading to the potential for unauthorized data disclosure."
}