What is the CVSS score of CVE-2026-48874?

CVE-2026-48874 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of GamiPress are affected by CVE-2026-48874?

GamiPress WordPress plugin versions 7.8.7 and earlier contains a SQL injection vulnerability allowing subscriber-level user accounts to read and exfiltrate sensitive database contents; no public…

How to fix or mitigate CVE-2026-48874?

Within 24 hours: Identify and inventory all WordPress installations running GamiPress plugin versions 7.8.7 or earlier. Within 7 days: Restrict or audit subscriber-level account creation; implement database query logging and monitoring; consider disabling plugin if operational alternative exists. Within 30 days: Establish monitoring of Patchstack advisory and official GamiPress channels for patch release; evaluate alternative gamification plugins; develop rapid deployment plan for patched version once available.

GamiPress CVE-2026-48874

EUVD-2026-36852 HIGH

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-xfmm-2ph2-w9fw

WordPress SQLi Gamipress Wordpress Plugin Ruben Garcia

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Network-reachable WordPress endpoint, low-complexity SQLi, requires subscriber auth (PR:L), no user interaction; SQLi reads cross-component database data (S:C, C:H) with limited write/availability effect (I:N, A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:47 vuln.today

DescriptionCVE.org

Subscriber SQL Injection in GamiPress <= 7.8.7 versions.

AnalysisAI

SQL injection in the GamiPress WordPress plugin versions 7.8.7 and earlier allows authenticated users with subscriber-level privileges to inject arbitrary SQL queries against the WordPress database. The flaw was reported by Patchstack and affects standard installations of the plugin, enabling attackers with the lowest authenticated role to read sensitive database contents and cause limited integrity or availability impact via the scope-changed condition. No public exploit identified at time of analysis.

Technical ContextAI

GamiPress is a WordPress gamification plugin (CPE cpe:2.3:a:ruben_garcia:gamipress:*) that awards points, achievements, and ranks to users; it integrates deeply with WordPress's MySQL/MariaDB backend through custom tables and queries. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-supplied input reaches a SQL query without adequate sanitization or parameterization - typically via insufficient use of $wpdb->prepare() or missing escaping on parameters reachable from a subscriber-accessible endpoint (AJAX action, REST route, or shortcode handler). Because WordPress subscribers are the lowest authenticated tier and exist by default on any site allowing user registration, the exploitable surface is broad.

RemediationAI

Upgrade GamiPress to a version newer than 7.8.7 per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-8-7-sql-injection-vulnerability; an exact fixed version is not stated in the available input, so verify the latest release on the WordPress plugin repository before updating. Until the patch is applied, compensating controls include disabling new user registration in WordPress Settings > General (trade-off: blocks legitimate community sign-ups), deactivating the GamiPress plugin entirely if gamification features are non-critical (trade-off: loses points/achievements functionality), or deploying a WAF rule (Patchstack, Wordfence, or equivalent) to block SQLi patterns on GamiPress AJAX/REST endpoints (trade-off: signature gaps may allow novel payloads). Auditing existing subscriber accounts and resetting credentials for any suspicious ones is also recommended.