GamiPress wpForo selector permits subscriber SQL injection
GamiPress through 7.9.7 passes the Subscriber-controlled q parameter from the gamipress_wpforo_get_posts AJAX action through $wpdb->esc_like() and then interpolates it directly into a single-quoted LIKE clause without a %s placeholder. Because esc_like() runs after WordPress magic quotes, MySQL receives a literal backslash followed by a live closing quote, enabling boolean-based SQL injection and extraction of sensitive database information. The wpForo plugin only needs to be active; its own code is not vulnerable. A Subscriber can obtain the required gamipress_admin nonce from an ordinary admin page such as /wp-admin/profile.php.
- Component
- GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
- Plugin slug
gamipress- Affected
- <= 7.9.7
- Safe version
- See mitigation notes
- Published
- Sep 11, 2026
This CVE was published Sep 11, 2026 and is one of 25 known issues for this plugin.
Update, patch or deactivate.
The authoritative export does not identify the first fixed release. Obtain a vendor-confirmed update after 7.9.7 or deactivate the affected wpForo integration until remediated. The query must use $wpdb->prepare() with a %s placeholder after constructing the LIKE pattern; esc_like() alone is not a SQL-injection defense.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N