SQL Injection Vulnerability in GamiPress Gamification Plugin for WordPress
CVE-2026-121792

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Gamipress – Gamification Plugin To Reward Points, Badges & Ranks In WordPress, Now With Ai
Vendor
CVE Published:
7 November 2026

What is CVE-2026-121792?

The GamiPress Gamification plugin, designed to enhance user engagement through rewards, is susceptible to a SQL Injection attack due to inadequate escaping in the user-input parameter. This vulnerability impacts all versions up to and including 8.1.1 and allows authenticated attackers with subscriber-level access and above to inject additional SQL queries. By compromising existing SQL queries linked to Gravity Forms, attackers may extract sensitive data from the database. The exploitation necessitates prior configuration of a GamiPress achievement related to Gravity Forms, making it critical for site administrators to ensure proper updates and secure coding practices.

Affected Version(s)

GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI 0 <= 8.1.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/gamipress/tags...
https://plugins.trac.wordpress.org/browser/gamipress/tags...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.