https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 11:44:37 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-15439 <p>The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the &#39;q&#39; parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb-&gt;esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\&#39; -&gt; \\&#39;), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher&#39;s Simple:Press vectors (PoC 2 &amp; 3) do not reproduce in current code, which uses $wpdb-&gt;prepare() with %s placeholders; only the wpForo selector is confirmed.</p> <p>The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the &#39;q&#39; parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb-&gt;esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\&#39; -&gt; \\&#39;), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher&#39;s Simple:Press vectors (PoC 2 &amp; 3) do not reproduce in current code, which uses $wpdb-&gt;prepare() with %s placeholders; only the wpForo selector is confirmed.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-15439 https://vulnerability.circl.lu/vuln/ghsa-3mqq-vp94-w5r5 <p>The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the &#39;q&#39; parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb-&gt;esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\&#39; -&gt; \\&#39;), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher&#39;s Simple:Press vectors (PoC 2 &amp; 3) do not reproduce in current code, which uses $wpdb-&gt;prepare() with %s placeholders; only the wpForo selector is confirmed.</p> <p>The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the &#39;q&#39; parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb-&gt;esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\&#39; -&gt; \\&#39;), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher&#39;s Simple:Press vectors (PoC 2 &amp; 3) do not reproduce in current code, which uses $wpdb-&gt;prepare() with %s placeholders; only the wpForo selector is confirmed.</p> https://vulnerability.circl.lu/vuln/ghsa-3mqq-vp94-w5r5