Authenticated SQL Injection in GamiPress Plugin for WordPress

CVE-2026-15439

What is CVE-2026-15439?

The GamiPress plugin for WordPress is susceptible to SQL Injection when the 'q' parameter is manipulated via the wpForo integration's AJAX selector. This vulnerability allows an attacker with a Subscriber+ account to exploit the lack of proper parameterization in SQL queries. The issue arises from the way the input is processed—specifically, the use of $wpdb->esc_like() followed by direct interpolation into a SQL query without appropriate placeholders. As a result, attackers can craft malicious input that is interpreted by MySQL in a way that allows for the execution of arbitrary SQL commands. This highlights the need for developers to utilize safe coding practices and ensure that SQL queries are properly prepared to prevent exploitation.

References