---
id: CVE-2026-121792
title: >-
  GamiPress <= 8.1.1 - Authenticated (Subscriber+) SQL Injection via 'Gravity
  Forms Name/List Field' Parameter
summary: >-
  The GamiPress – Gamification plugin to reward points, badges & ranks in
  WordPress, now with AI plugin for WordPress is vulnerable to generic SQL
  Injection via the 'input_<field_id>.<part> (Gravity Forms name-field part, or
  list-field row…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: rubengc
product: >-
  GamiPress – Gamification plugin to reward points, badges & ranks in WordPress,
  now with AI
affected:
  - >-
    gamipress_gamification_plugin_to_reward_points_badges_ranks_in_wordpress_now_with_ai
    <= 8.1.1
published: '2026-11-07'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T06:39:39.568Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121792'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/9fa05058-3c16-4e61-bd6a-a1a09d2f56cc?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/gamipress/tags/8.1.1/includes/functions/logs.php#L326
  - url: >-
      https://plugins.trac.wordpress.org/browser/gamipress/tags/8.1.1/includes/functions/logs.php#L386
  - url: >-
      https://plugins.trac.wordpress.org/browser/gamipress/tags/8.1.1/integrations/gravity-forms/includes/triggers.php#L256
  - url: >-
      https://plugins.trac.wordpress.org/browser/gamipress/tags/8.1.1/integrations/gravity-forms/includes/listeners.php#L126
  - url: >-
      https://plugins.trac.wordpress.org/browser/gamipress/tags/8.1.1/integrations/gravity-forms/includes/listeners.php#L65
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3787551%40gamipress&new=3787551%40gamipress
tags:
  - cve.org
ingestedAt: '2026-11-07T07:12:31.875Z'
epss: 0.0028
epssPercentile: 0.20659
---

## Overview

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_<field_id>.<part> (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.

## Affected

- `gamipress_gamification_plugin_to_reward_points_badges_ranks_in_wordpress_now_with_ai <= 8.1.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.