Description

Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-30T13:17:25.583Z",
  "pubdate": "2026-09-30T13:17:25.583Z",
  "executiveSummary": "GamiPress versions 8.0.2 and earlier are susceptible to an unauthenticated SQL injection vulnerability.\nThis flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL statements via unsanitized input vectors.\nThe vulnerability poses a critical risk to the confidentiality, integrity, and availability of the affected WordPress environment.\nSuccessful exploitation enables unauthorized database access, potentially leading to sensitive data exfiltration, modification of application records, or full administrative account compromise.\nThe vulnerability does not require user interaction or prior authentication, making it accessible to any remote actor with network visibility to the targeted application.\nImpacted systems remain vulnerable until the application is updated to a version where input sanitization controls have been implemented.",
  "technicalDetails": "The vulnerability originates from the improper sanitization and validation of user-supplied input before it is incorporated into database queries within the GamiPress plugin.\nIn versions 8.0.2 and below, specific plugin parameters processed by backend functions fail to employ parameterized queries or adequate escaping mechanisms, allowing for SQL command injection.\nThe attack flow begins with the attacker identifying an input parameter that interacts directly with the database layer. By submitting a crafted HTTP request containing malicious SQL syntax, the attacker can break out of the intended query structure.\nBecause the application executes these queries with the privileges of the web application user, the injected SQL commands are processed by the database engine, effectively altering the logic of the original query.\nAn attacker can leverage UNION-based SQL injection to extract data from other tables within the database, including the 'wp_users' table, which often contains hashed passwords and user metadata.\nFurthermore, the injection vector may allow for time-based or boolean-based blind exploitation techniques, enabling attackers to systematically reconstruct database content even if direct query results are not returned in the HTTP response body.\nThe lack of authentication requirements significantly lowers the barrier for entry, as the exploitation vector is reachable via standard web requests without established sessions.\nPost-exploitation impact includes unauthorized modification of user data, such as promoting low-privileged accounts to administrative roles, or the deletion of application data, resulting in a denial-of-service condition.\nThe vulnerability resides within the plugin's core data handling logic, specifically affecting components that facilitate dynamic database interactions without strict adherence to the WordPress 'wpdb' prepare() method best practices."
}