{"id":"CVE-2026-121792","kind":"vulnerability","aliases":["CVE-2026-121792"],"related":[],"title":"GamiPress WordPress plugin: SQL injection lets subscribers read database contents","description":"The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_<field_id>.<part> (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.","summary":"The GamiPress gamification plugin for WordPress has an SQL injection flaw in its Gravity Forms integration, affecting versions up to and including 8.1.1. A logged-in subscriber can append extra SQL queries through a form field parameter and extract sensitive data from the database.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gamipress","gravity-forms","package","self-hosted","wordpress"],"not_affected_if":["auth-required","no-field-value-achievement","no-gravity-forms-integration"],"how_to_check":"- Check the installed GamiPress version in the WordPress plugins screen or the plugin header in `gamipress.php`, and compare it with the fixed version.\n- Look for a GamiPress achievement configured against a Gravity Forms 'field value submission' event with a published form.","fix":"- GamiPress: move to a version later than `8.1.1` (the fixed version is not stated in the sources).","status":"open","published_at":"2026-11-07T07:17:04+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","triaged_at":"2026-11-07T07:47:04+00:00","updated_at":"2026-11-07T07:47:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T07:47:04Z","model":"claude-haiku-5-5","output":{"fix":"- GamiPress: move to a version later than `8.1.1` (the fixed version is not stated in the sources).","reach":"internet","title":"GamiPress WordPress plugin: SQL injection lets subscribers read database contents","impact":"high","summary":"The GamiPress gamification plugin for WordPress has an SQL injection flaw in its Gravity Forms integration, affecting versions up to and including 8.1.1. A logged-in subscriber can append extra SQL queries through a form field parameter and extract sensitive data from the database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gamipress","gravity-forms","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"subscriber reads database contents, including user and site data","analyst_note":"Confirm the fixed GamiPress version beyond 8.1.1 from the vendor changelog or the NVD entry, since the sources give none.","how_to_check":"- Check the installed GamiPress version in the WordPress plugins screen or the plugin header in `gamipress.php`, and compare it with the fixed version.\n- Look for a GamiPress achievement configured against a Gravity Forms 'field value submission' event with a published form.","plain_action":"","needs_analyst":true,"not_affected_if":["no-gravity-forms-integration","no-field-value-achievement","auth-required"],"who_is_affected":"Sites running GamiPress up to and including 8.1.1 that also use the Gravity Forms integration with a 'field value submission' achievement and a published form. An attacker needs a subscriber-level account, which open registration may allow. Sites without that Gravity Forms setup are not exposed through this parameter.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000758,"input_tokens":4398,"output_tokens":636,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121792':13A,16A '-2026':12A,15A '8.1.1':48B,116C 'access':147C 'achiev':174C 'addit':152C 'affect':42B 'ai':84C 'alreadi':156C,175C 'append':55B,151C 'attack':142C 'authent':141C 'badg':78C 'configur':176C 'content':10A 'correspond':187C 'cve':11A,14A 'data':67B 'databas':9A,70B,169C 'due':117C 'escap':120C 'event':184C 'exist':133C,157C 'exploit':170C 'extra':56B 'extract':65B,164C 'field':62B,101C,106C,181C 'flaw':36B 'form':20B,40B,61B,98C,180C,188C 'gamif':28B,73C 'gamipress':1A,17B,27B,72C,173C 'generic':91C 'graviti':19B,39B,97C,179C 'gravity-form':18B 'host':24B 'includ':47B,115C 'inform':166C 'inject':5A,35B,93C 'input':96C 'insuffici':119C 'integr':41B,197C 'lack':127C 'let':6A 'level':146C 'list':105C 'list-field':104C 'log':51B 'logged-in':50B 'make':137C 'name':100C 'name-field':99C 'packag':21B 'paramet':63B,108C,125C 'part':102C 'plugin':3A,29B,74C,85C 'point':77C 'possibl':139C 'prepar':130C 'publish':189C 'queri':58B,135C,154C,158C 'rank':79C 'read':8A 'requir':171C 'reward':76C 'row':107C 'self':23B 'self-host':22B 'sensit':66B,165C 'setup':192C 'site':194C 'sql':4A,34B,57B,92C,134C,153C 'standard':191C 'submiss':183C 'subscrib':7A,53B,145C 'subscriber-level':144C 'suffici':129C 'suppli':124C 'use':162C,195C 'user':123C 'valu':182C 'version':43B,111C 'via':94C 'vulner':89C 'wordpress':2A,25B,31B,81C,87C","nicknames":[],"mitigations":[],"who_affected":"Sites running GamiPress up to and including 8.1.1 that also use the Gravity Forms integration with a 'field value submission' achievement and a published form. An attacker needs a subscriber-level account, which open registration may allow. Sites without that Gravity Forms setup are not exposed through this parameter.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gamipress","gravityforms","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-121792':13A,16A '-2026':12A,15A 'content':10A 'cve':11A,14A 'databas':9A 'gamipress':1A 'inject':5A 'let':6A 'plugin':3A 'read':8A 'sql':4A 'subscrib':7A 'wordpress':2A","search_b":"'8.1.1':48B 'affect':42B 'append':55B 'data':67B 'databas':70B 'extra':56B 'extract':65B 'field':62B 'flaw':36B 'form':20B,40B,61B 'gamif':28B 'gamipress':17B,27B 'graviti':19B,39B 'gravity-form':18B 'host':24B 'includ':47B 'inject':35B 'integr':41B 'log':51B 'logged-in':50B 'packag':21B 'paramet':63B 'plugin':29B 'queri':58B 'self':23B 'self-host':22B 'sensit':66B 'sql':34B,57B 'subscrib':53B 'version':43B 'wordpress':25B,31B","search_c":"'8.1.1':116C 'access':147C 'achiev':174C 'addit':152C 'ai':84C 'alreadi':156C,175C 'append':151C 'attack':142C 'authent':141C 'badg':78C 'configur':176C 'correspond':187C 'databas':169C 'due':117C 'escap':120C 'event':184C 'exist':133C,157C 'exploit':170C 'extract':164C 'field':101C,106C,181C 'form':98C,180C,188C 'gamif':73C 'gamipress':72C,173C 'generic':91C 'graviti':97C,179C 'includ':115C 'inform':166C 'inject':93C 'input':96C 'insuffici':119C 'integr':197C 'lack':127C 'level':146C 'list':105C 'list-field':104C 'make':137C 'name':100C 'name-field':99C 'paramet':108C,125C 'part':102C 'plugin':74C,85C 'point':77C 'possibl':139C 'prepar':130C 'publish':189C 'queri':135C,154C,158C 'rank':79C 'requir':171C 'reward':76C 'row':107C 'sensit':165C 'setup':192C 'site':194C 'sql':92C,134C,153C 'standard':191C 'submiss':183C 'subscrib':145C 'subscriber-level':144C 'suffici':129C 'suppli':124C 'use':162C,195C 'user':123C 'valu':182C 'version':111C 'via':94C 'vulner':89C 'wordpress':81C,87C","first_public_at":"2026-11-07T07:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121792","severity":null,"published_at":"2026-11-07T07:17:04+00:00","modified_at":"2026-11-07T07:17:04+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","fetched_at":"2026-11-07T07:46:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}