---
id: "CVE-2026-121792"
page: "https://infrastack.ai/live/CVE-2026-121792"
kind: "vulnerability"
aliases: ["CVE-2026-121792"]
title: "GamiPress WordPress plugin: SQL injection lets subscribers read database contents"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gamipress", "gravity-forms", "package", "self-hosted", "wordpress"]
not_affected_if: ["auth-required", "no-field-value-achievement", "no-gravity-forms-integration"]
published_at: "2026-11-07T07:17:04+00:00"
first_seen_at: "2026-11-07T07:46:07+00:00"
updated_at: "2026-11-07T07:47:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121792", "first_seen_at": "2026-11-07T07:46:07+00:00"}]
exploit_sources: []
---

# GamiPress WordPress plugin: SQL injection lets subscribers read database contents

Link for people: https://infrastack.ai/live/CVE-2026-121792 (this .md is for agents)

The GamiPress gamification plugin for WordPress has an SQL injection flaw in its Gravity Forms integration, affecting versions up to and including 8.1.1. A logged-in subscriber can append extra SQL queries through a form field parameter and extract sensitive data from the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GamiPress version in the WordPress plugins screen or the plugin header in `gamipress.php`, and compare it with the fixed version.
- Look for a GamiPress achievement configured against a Gravity Forms 'field value submission' event with a published form.

## Fix

- GamiPress: move to a version later than `8.1.1` (the fixed version is not stated in the sources).

## Timeline

- 2026-11-07T07:46:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121792

## From the sources

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_<field_id>.<part> (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_