# CVE-2026-48874: GamiPress SQL injection in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-48874-gamipress-sql-injection-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-48874 · Severity: high · CVSS 8.5 · Published 2026-06-15

GamiPress is a popular WordPress plugin used to add gamification features like points, badges, and rewards to websites. A security flaw allows users with basic 'Subscriber' accounts to perform unauthorized database queries. This could lead to the theft of sensitive customer data, exposure of site configuration details, or disruption of website operations.

Technologies: [GamiPress](https://junglewise.ai/threats/technologies/gamipress). Vendors: [GamiPress](https://junglewise.ai/threats/vendors/gamipress).

## Quick answers

**Is CVE-2026-48874 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48874 being exploited in the wild.

**How severe is CVE-2026-48874?** High severity, with a CVSS score of 8.5, published 15 June 2026.

**Which products and versions are affected?** GamiPress <= 7.8.7.

**Is there a fix for CVE-2026-48874?** A patch was published on 2026-06-02: Patch released in version 7.8.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48874 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48874?** Check whether you run GamiPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the GamiPress plugin for WordPress due to improper neutralization of special elements in SQL commands (CWE-89). The flaw is accessible to authenticated users with at least 'Subscriber' level privileges. By sending specially crafted requests, a remote attacker can bypass intended query logic to extract sensitive information from the WordPress database or cause minor service disruptions. The vulnerability is mitigated in version 7.8.8. The CVSS 3.1 score of 8.5 reflects a high impact on confidentiality due to the potential for full database readout.

## Affected products

- GamiPress GamiPress <= 7.8.7

## Timeline

- 2026-04-28: other: Reported by researcher kai63001
- 2026-06-02: patched: Patch released in version 7.8.8
- 2026-06-15: advisory: NVD and Patchstack advisories published

## References

- [https://patchstack.com/database/wordpress/plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-8-7-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-8-7-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [GamiPress SQL Injection via Gravity Forms field parameter](https://junglewise.ai/threats/cve-2026-121792-the-gamipress-gamification-plugin-to-reward-points-badges-ranks)
- [GamiPress stored cross-site scripting in video_id parameter](https://junglewise.ai/threats/cve-2026-14379-the-gamipress-gamification-plugin-to-reward-points-achievements)
- [GamiPress SQL injection in REST API](https://junglewise.ai/threats/cve-2026-94177-unauthenticated-sql-injection-in-gamipress-8-0-2-versions)
- [GamiPress SQL Injection in wpForo AJAX selector](https://junglewise.ai/threats/cve-2026-15439-gamipress-sql-injection-in-wpforo-ajax-selector)
- [GamiPress arbitrary user points and achievement award via video watch tracking](https://junglewise.ai/threats/cve-2026-77764-gamipress-arbitrary-user-points-and-achievement-award-via-video)