CVE-2026-15439: GamiPress <= 7.9.7 - Authenticated (Subscriber+) SQL Injection
The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipresswpforogetposts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esclike() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esclike() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipressadmin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GamiPress (wpForo integration)to a version that resolves this vulnerability.Fixed in 7.9.7 - Compensating control
If GamiPress is not required for wpForo integration, disable the wpForo integration/feature in GamiPress so the AJAX selector action gamipress_wpforo_get_posts (action triggered by the wpForo selector with q parameter) is not reachable.
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using GamiPress version 7.9.7 or earlier are exposed when the wpForo plugin is active. wpForo only needs to be active so that the affected AJAX callback is registered; no separate wpForo vulnerability is required.
What access does an attacker need?
An attacker needs a WordPress Subscriber-level account or higher and access to the gamipress_admin nonce. The nonce is exposed on WordPress admin pages that a Subscriber can access, such as /wp-admin/profile.php.
What is the confirmed attack path?
The confirmed path is the wpForo integration AJAX selector using the gamipress_wpforo_get_posts action and its q parameter. The documented Simple:Press proof-of-concept vectors are not confirmed in current code because those paths use $wpdb->prepare() with %s placeholders.
What can be done if GamiPress cannot be updated immediately?
Disable the wpForo plugin or otherwise prevent the affected wpForo integration callback from being available. Restricting untrusted user registration and Subscriber account access also reduces exposure, since exploitation requires an authenticated Subscriber-level account.