CVE-2026-48874: WordPress GamiPress plugin <= 7.8.7 - SQL Injection vulnerability

Synopsis

This is a SQL injection vulnerability in the GamiPress WordPress plugin, affecting all versions up to and including 7.8.7. The flaw is reachable over the network and requires only a low-privilege account (subscriber-level) to exploit, with no additional user interaction needed. Successful exploitation gives an attacker read access to sensitive database contents and causes minor disruption to availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationRequired

  A low-privilege account (subscriber-level or equivalent) is sufficient; no administrative access is needed to trigger the injection.

• Victim interactionNot required

  The attacker can execute the injection directly without any action from another user or administrator.

• Attack complexityDetail

  Exploit reliability is high and requires no special conditions, race windows, or memory layout knowledge.

Blast Radius

• Reads arbitrary database rows, including stored user credentials, session tokens, and private WordPress content.
• The scope of the injection crosses into database tables beyond the plugin's own data, due to the changed scope indicator in the CVSS vector.
• Causes minor disruption to database availability, which may produce intermittent errors for site visitors or administrators.