CVE-2024-1799 Overview
CVE-2024-1799 is a SQL Injection vulnerability [CWE-89] in the GamiPress plugin for WordPress. The flaw resides in the achievement_types attribute of the gamipress_earnings shortcode. All versions up to and including 6.8.6 are affected due to insufficient escaping of user-supplied input and lack of adequate query preparation.
Authenticated attackers with contributor-level access or above can append additional SQL statements to existing queries. This enables extraction of sensitive information from the WordPress database, including credentials and session data.
Critical Impact
Authenticated contributors can execute arbitrary SQL queries against the WordPress database, exposing sensitive data such as user credentials and authentication tokens.
Affected Products
- GamiPress plugin for WordPress, all versions up to and including 6.8.6
- WordPress sites using the gamipress_earnings shortcode
- Any WordPress instance where contributor-level accounts exist and the plugin is active
Discovery Timeline
- 2024-03-20 - CVE-2024-1799 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1799
Vulnerability Analysis
The GamiPress plugin registers the gamipress_earnings shortcode to render user achievement earnings. The shortcode accepts an achievement_types attribute that is concatenated directly into a SQL query without proper sanitization or parameterized binding.
Because WordPress contributors can author posts containing shortcodes, an attacker with contributor privileges can craft a post embedding the malicious shortcode. When the shortcode renders, the injected SQL executes with the database privileges of the WordPress application user.
Root Cause
The root cause is a combination of two coding failures. First, the plugin does not escape the achievement_types attribute using esc_sql() or a similar sanitizer before concatenation. Second, the underlying query is not built with $wpdb->prepare() using placeholders. Together, these omissions leave the query string open to injection [CWE-89].
Attack Vector
Exploitation proceeds over the network by an authenticated contributor. The attacker creates or edits a post that includes the vulnerable shortcode with a malicious achievement_types value. When the post is previewed or rendered, the injected payload executes within the SQL query. The attacker can use UNION SELECT clauses to extract data from arbitrary tables, including wp_users password hashes and wp_usermeta session tokens.
No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report for technical details.
Detection Methods for CVE-2024-1799
Indicators of Compromise
- Post or page content containing [gamipress_earnings ...] shortcodes with SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA inside the achievement_types attribute.
- Unexpected database queries in MySQL slow query logs referencing wp_users or wp_usermeta originating from GamiPress plugin code paths.
- New or modified posts authored by contributor-level accounts that reference the gamipress_earnings shortcode.
Detection Strategies
- Audit wp_posts table post_content for the string gamipress_earnings combined with SQL metacharacters or reserved words.
- Enable WordPress query logging or install a database activity monitor to flag queries containing UNION SELECT originating from plugin execution.
- Review web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor accounts followed by GET requests rendering the modified post.
Monitoring Recommendations
- Alert on any contributor account creating posts that include shortcode attributes exceeding normal length or containing SQL syntax.
- Monitor for privilege escalation activity following suspected exploitation, including new administrator accounts or modified wp_options values.
- Track outbound traffic from the WordPress host for signs of data exfiltration following shortcode rendering.
How to Mitigate CVE-2024-1799
Immediate Actions Required
- Update the GamiPress plugin to a version later than 6.8.6 immediately.
- Audit all existing contributor, author, and editor accounts, and remove any that are not required.
- Review recent posts and pages for the gamipress_earnings shortcode and inspect the attributes for injection payloads.
- Rotate WordPress administrator passwords and secret keys defined in wp-config.php if exploitation is suspected.
Patch Information
The vendor addressed the issue in the GamiPress plugin repository. See the WordPress Plugin Changeset for the code-level fix, which introduces proper escaping and prepared statements for the achievement_types attribute.
Workarounds
- If patching is not immediately possible, deactivate the GamiPress plugin until the update can be applied.
- Restrict contributor and higher role assignments to trusted users only, and disable open user registration where feasible.
- Deploy a web application firewall rule to block requests containing SQL keywords within gamipress_earnings shortcode parameters.
# Configuration example: disable open registration and downgrade unnecessary contributor accounts
wp option update users_can_register 0
wp user list --role=contributor --field=ID | xargs -I {} wp user set-role {} subscriber
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
