Live › vulnerability › CVE-2026-112837
Go to dashboardThe GamiPress WordPress gamification plugin contains a blind SQL injection flaw in versions through 8.0.7. An attacker can run database queries through the vulnerable input and read site data one inference at a time.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the GamiPress plugin version 8.0.7 or earlier are affected, typically WordPress sites using it for points, badges or achievements. The sources do not say which specific feature or input is vulnerable, so any site with the plugin active should be treated as exposed. Sites without GamiPress installed can skip it.
No product ranges from the sources yet.
wp plugin get gamipress --field=version8.0.78.0.7 once the vendor publishes a patched release (unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia GamiPress gamipress allows Blind SQL Injection.This issue affects GamiPress: from n/a through 8.0.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-112837")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.