CVE-2026-121792 · Package
NO FIX YET · SEE WHAT TO DO
The GamiPress gamification plugin for WordPress has an SQL injection flaw in its Gravity Forms integration, affecting versions up to and including 8.1.1. A logged-in subscriber can append extra SQL queries through a form field parameter and extract sensitive data from the database.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running GamiPress up to and including 8.1.1 that also use the Gravity Forms integration with a 'field value submission' achievement and a published form. An attacker needs a subscriber-level account, which open registration may allow. Sites without that Gravity Forms setup are not exposed through this parameter.
Not affected if auth-required, no-field-value-achievement, no-gravity-forms-integration
Who cares gamipress, gravity-forms, self-hosted, wordpress
gamipress.php, and compare it with the fixed version.8.1.1 (the fixed version is not stated in the sources).The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_<field_id>.<part> (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.