GamiPress WordPress plugin: Blind SQL injection
Summary
The GamiPress WordPress plugin up to and including version 8.0.7 is affected by a blind SQL injection vulnerability (CWE-89). A remote attacker can infer data from the database by observing application responses and timing, which can expose sensitive information such as user accounts and customer data. The required privilege is low, so a registered or low-privileged account may be sufficient; this has not been confirmed by the sources.
Affected
- GamiPress WordPress plugin up to and including 8.0.7
- Earliest affected version: Unknown (listed as n/a in the CVE record)
Fixed in
- Version 8.0.8 (Patchstack patched version)
- Current release per WordPress.org: 8.1.1 (not verified for further fixes)
Workaround
- Patchstack customers: a mitigation rule is reported to block attacks until the plugin is updated
- Without a patch: WAF rules tuned to detect SQL injection patterns may help; this is general advice, not a verified rule for this CVE
Exploitation
- Exploited in the wild: not confirmed
- Patchstack expects exploitation (forecast, not a confirmed attack)
- Public proof of concept: none found in the research, which does not prove that none exists
- EPSS: 0.00211 (low)
- Scores conflict: CNA/Patchstack CVSS 8.5; VulDB CVSS 6.3
Our recommendation
- Check whether GamiPress is installed on any WordPress site, including client sites
- Update GamiPress to version 8.0.8 or later
- Check whether Patchstack or a WAF covers the affected sites
- Review user accounts and logs for unusual database-related requests
- Prioritise sites used for memberships, loyalty programmes or customer accounts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- VulDB CVE entry vuldb.com
- VulDB vulnerability 425604 vuldb.com
- Vulners NVD entry vulners.com
- WordPress.org GamiPress plugin page wordpress.org
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:14.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.