GamiPress: Blind SQL injection in WordPress plugin
Summary
GamiPress, a WordPress plugin, contains a blind SQL injection vulnerability (CWE-89) in versions up to and including 8.0.2. An attacker can send crafted requests to the website to read, modify or delete database content, including user accounts and private data. Sources disagree on whether authentication is required, so assume the worst case. Exploitation status is conflicting and unverified.
Affected
- GamiPress WordPress plugin 8.0.2 and earlier (lower bound not stated)
Fixed in
- 8.0.3 (per CVE record and Patchstack)
- A later release, 8.0.8, is named in a related Patchstack advisory for a different CVE; not confirmed for this CVE
Workaround
- Unknown from vendor.
- Patchstack reports a mitigation rule for its customers that blocks attacks; this is a virtual patch, not a vendor fix.
- If updating is not possible, ask your hosting provider or web developer for help.
Exploitation
- Conflicting: Vulners lists an 'exploited' tag linked to CISA KEV dated 18 Oct 2026 and a VulnCheck KEV entry dated 19 Oct 2026. Not verified.
- Strix shows 'KEV: No' on an older page.
- Patchstack expects exploitation and mass campaigns; this is a prediction.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- Public proof of concept: Unknown.
Our recommendation
- Check now whether GamiPress is installed and which version is active.
- Update to the latest release (at least 8.0.3; a later advisory names 8.0.8).
- If patching is delayed, use a WAF or virtual patching and consider disabling the plugin if it is not essential.
- Review logs for unusual database queries and check user accounts for unauthorised changes.
- Do not lower the priority because NVD status is Deferred.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: GamiPress SQL injection (8.0.2) patchstack.com
- Vulners: CIRCL:CVE-2026-94177 vulners.com
- Strix: CVE-2026-94177 www.strix.ai
- Patchstack: GamiPress vulnerability list patchstack.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:43.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.