GamiPress Vulnerable to SQL Injection, Sensitive Information at Risk

CVE-2024-1799

Summary

The GamiPress plugin for WordPress, widely used for gamification purposes, is exposed to a SQL Injection vulnerability through the 'achievement_types' attribute within the gamipress_earnings shortcode. This issue affects all versions up to and including 6.8.6. The vulnerability arises from insufficient escaping of user-supplied parameters and inadequate preparation of existing SQL queries. With contributor-level access or higher, authenticated attackers can manipulate SQL queries, allowing them to potentially extract sensitive data from the database. Proper security measures and updates are recommended to mitigate risks associated with this vulnerability.

References