Quick answers
- Is CVE-2026-48874 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-48874 being exploited in the wild.
- How severe is CVE-2026-48874?
- High severity, with a CVSS score of 8.5, published 15 June 2026.
- Which products and versions are affected?
- GamiPress <= 7.8.7.
- Is there a fix for CVE-2026-48874?
- A patch was published on 2026-06-02: Patch released in version 7.8.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-48874 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-48874?
- Check whether you run GamiPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A SQL injection vulnerability exists in the GamiPress plugin for WordPress due to improper neutralization of special elements in SQL commands (CWE-89). The flaw is accessible to authenticated users with at least 'Subscriber' level privileges. By sending specially crafted requests, a remote attacker can bypass intended query logic to extract sensitive information from the WordPress database or cause minor service disruptions. The vulnerability is mitigated in version 7.8.8. The CVSS 3.1 score of 8.5 reflects a high impact on confidentiality due to the potential for full database readout.
Affected products
- GamiPress GamiPress <= 7.8.7
Timeline
- 2026-04-28: other: Reported by researcher kai63001
- 2026-06-02: patched: Patch released in version 7.8.8
- 2026-06-15: advisory: NVD and Patchstack advisories published