GamiPress CVE-2026-94177

Requires a target WordPress site running the GamiPress plugin at version 8.0.2 or earlier. The Description states exploitation is unauthenticated (no account needed), which would make this remotely exploitable against default installations; however, the provided CVSS vector specifies PR:L, implying a low-privilege authenticated account (commonly obtainable via open user registration on gamification/community sites) may be required - this discrepancy limits confident assessment and should be verified with the vendor. No user interaction is required (UI:N) and the attack is over the network (AV:N) with low complexity (AC:L). The specific vulnerable parameter or endpoint is not identified in the available data.

This is CWE-89 SQL injection in the GamiPress WordPress plugin (<= 8.0.2), reported by Patchstack with a CVSS 3.1 base score of 8.5. There is a material internal conflict in the input: the Description explicitly states 'Unauthenticated SQL Injection,' yet the provided CVSS vector uses PR:L (authenticated, low privilege) - these disagree on the single most important exploitation gate, and it should be verified against the Patchstack advisory. If the Description is correct (unauthenticated), real-world risk is high: SQL injection over the network with no privileges and no user interaction is directly and reliably exploitable, and SQLi is among the most commonly weaponized WordPress plugin bug classes. If the vector's PR:L is correct, an attacker still only needs a low-privilege account (e.g. subscriber-level self-registration, which is common on gamification/community sites), keeping practical risk elevated. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization yet - this is a patch-priority based on exploitability and plugin footprint, not on confirmed in-the-wild activity. The vector's S:C (scope change) and A:L are also atypical for a pure read-oriented SQLi and read as vendor-conservative; the dominant real impact is confidentiality (C:H) via database extraction.

An attacker sends a crafted HTTP request to a vulnerable GamiPress endpoint on a WordPress site running plugin version <= 8.0.2, injecting SQL into an unsanitized parameter. Per the Description this requires no authentication (though the supplied CVSS vector indicates a low-privilege account may be needed), and the attacker extracts sensitive data such as WordPress user records and password hashes from the database. No public exploit code was identified at time of analysis, but SQLi in popular plugins is routinely reverse-engineered from vendor advisories.