GamiPress EUVD-2026-108627

Exploitation requires an authenticated session on the target WordPress site (PR:L in the supplied vector), so an attacker must first hold or obtain a plugin/site account; the exact minimum role and the specific vulnerable GamiPress parameter or feature are not described in the available sources. The flaw is reachable over the network against sites running GamiPress versions up to and including 8.0.7. Limiting factors: the authentication requirement bounds who can exploit it, and the blind nature means data must be inferred incrementally rather than returned directly, which slows mass extraction; the trigger mechanism and any non-default configuration dependency are not stated in the available sources.

This is a credible but not emergency-grade priority. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, base 8.5) indicates a network-reachable, low-complexity blind SQL injection that requires some authenticated privilege (PR:L) rather than full anonymous access. The vuln.today decision label is 'this_week', which aligns with a serious-but-not-act_now posture. No CISA KEV listing is present, so there is no confirmed active exploitation; no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from this data; and the sole reference is the Patchstack advisory rather than working exploit code, so this is best treated as 'no public exploit identified at time of analysis.' A notable tension: the input vector asserts S:C (scope change) and C:H with I:N, which is atypical for SQL injection - blind SQLi normally reads database contents within the application's own security scope and often permits some data modification, so the S:C and I:N choices should be verified against the Patchstack advisory. Net assessment: a real, patch-worthy authenticated SQLi in a widely-used plugin, warranting prompt remediation but not the drop-everything urgency reserved for KEV/act_now items.

An attacker holding a low-privilege authenticated account on a WordPress site running GamiPress 8.0.7 or earlier sends crafted input to an affected plugin parameter, and because the input is not properly neutralized, it is concatenated into an SQL query. Using blind (inference-based) techniques, the attacker extracts database contents such as user records and password hashes one condition at a time. No working public exploit is confirmed in the provided sources; only the Patchstack advisory reference exists.