{"id":21083,"date":"2026-09-12T00:30:55","date_gmt":"2026-09-11T16:30:55","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-15439"},"modified":"2026-09-12T00:30:55","modified_gmt":"2026-09-11T16:30:55","slug":"cve-2026-15439","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-15439","title":{"rendered":"CVE-2026-15439 [MEDIUM] &#8211; The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Inject"},"content":{"rendered":"<p>The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the &#8216;q&#8217; parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb-&gt;esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (&#8216; -&gt; \\&#8217;), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. \/wp-admin\/profile.php). Note: the researcher&#8217;s Simple:Press vectors (PoC 2 &amp; 3) do not reproduce in current code, which uses $wpdb-&gt;prepare() with %s placeholders; only the wpForo selector is confirmed.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the &#8216;q&#8217; parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21083","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21083","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}