CVE-2026-15439: GamiPress WordPress Plugin SQLI Vulnerability

CVE-2026-15439 Overview

CVE-2026-15439 is an authenticated SQL Injection vulnerability [CWE-89] in the GamiPress plugin for WordPress, affecting versions up to and including 7.9.7. The flaw exists in the wpForo integration AJAX selector registered under the action gamipress_wpforo_get_posts. The q parameter is passed through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause without a %s placeholder. An attacker with a Subscriber-level account can extract data from the WordPress database using boolean-based injection. The wpForo plugin only needs to be active for the vulnerable callback to register.

Critical Impact
Authenticated attackers with Subscriber privileges can extract sensitive data — including user credentials and session information — from the WordPress database via boolean-based SQL injection.

Affected Products

GamiPress plugin for WordPress, versions up to and including 7.9.7
WordPress sites with both GamiPress and wpForo plugins active
Any WordPress installation permitting Subscriber-level registration on vulnerable GamiPress versions

Discovery Timeline

2026-09-11 - CVE-2026-15439 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-15439

Vulnerability Analysis

The vulnerability resides in the wpForo integration functions within GamiPress, specifically in the code path handling the gamipress_wpforo_get_posts AJAX action. The plugin registers this callback whenever wpForo is active, without requiring any wpForo vulnerability itself. When the AJAX handler receives the q search parameter, it applies $wpdb->esc_like() and injects the result directly into a single-quoted LIKE clause in a raw SQL query. No parameterized query construction with $wpdb->prepare() and %s placeholders is used at this call site.

Exploitation requires only a Subscriber account. The gamipress_admin nonce needed for the AJAX call is exposed on every admin page — for example, /wp-admin/profile.php — which is reachable by any authenticated user. This lowers the barrier to exploitation on sites that permit open user registration.

The researcher's additional Simple:Press vectors (PoC 2 and PoC 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders. Only the wpForo selector path is confirmed as exploitable.

Root Cause

The root cause is an ordering interaction between WordPress core magic quotes and esc_like(). WordPress adds a slash to escape a single quote in input (\'). When esc_like() runs afterward, it escapes the backslash by doubling it, producing \\'. MySQL parses this sequence as one literal backslash followed by an unescaped closing single quote, breaking out of the intended string literal and enabling SQL injection.

Attack Vector

The attack is remotely exploitable over the network by any authenticated user holding at least Subscriber privileges. The attacker retrieves the gamipress_admin nonce from any admin-accessible page, then submits a crafted q parameter to the gamipress_wpforo_get_posts AJAX endpoint. Boolean-based blind SQL injection allows incremental extraction of database contents including user hashes and session tokens.

Refer to the Wordfence Vulnerability Analysis and the vulnerable WordPress GamiPress Function Code for technical details.

Detection Methods for CVE-2026-15439

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php with action=gamipress_wpforo_get_posts and unusual characters (backslash, single quote, OR, AND, SLEEP) in the q parameter.
Repeated AJAX calls originating from low-privilege Subscriber accounts targeting the GamiPress endpoint.
MySQL error log entries referencing malformed LIKE clauses tied to GamiPress queries.

Detection Strategies

Inspect web server access logs for admin-ajax.php requests containing the gamipress_wpforo_get_posts action combined with encoded SQL metacharacters in the q value.
Deploy web application firewall (WAF) rules that flag boolean-based injection payloads (for example, ' OR '1'='1) targeting WordPress AJAX endpoints.
Correlate new Subscriber account registrations with subsequent admin-page visits that read the gamipress_admin nonce.

Monitoring Recommendations

Enable MySQL general or slow query logging temporarily to identify anomalous LIKE patterns emerging from GamiPress query paths.
Track authenticated request volume per Subscriber account and alert on sudden bursts against admin-ajax.php.
Monitor for database enumeration patterns such as sequential character-guessing queries typical of boolean-based blind SQLi.

How to Mitigate CVE-2026-15439

Immediate Actions Required

Update the GamiPress plugin to a version newer than 7.9.7 as soon as a fixed release is published by the vendor.
Audit WordPress user accounts and remove unused or unrecognized Subscriber accounts.
Disable open user registration temporarily if the site does not require it.

Patch Information

At the time of publication, no fixed version is listed in the enriched CVE data. Review the Wordfence Vulnerability Analysis and the GamiPress plugin changelog for the latest patched release, and apply it promptly.

Workarounds

Deactivate the wpForo plugin on affected sites; the vulnerable gamipress_wpforo_get_posts callback is only registered when wpForo is active.
Restrict access to /wp-admin/admin-ajax.php for low-privilege roles using WAF rules or plugin-level access controls.
Apply a virtual patch via a WAF that blocks requests with backslash or single-quote characters in the q parameter of the gamipress_wpforo_get_posts action.

bash

# Example ModSecurity rule to block suspicious payloads on the vulnerable AJAX action
SecRule ARGS:action "@streq gamipress_wpforo_get_posts" \
    "chain,id:1015439,phase:2,deny,status:403,msg:'CVE-2026-15439 GamiPress SQLi attempt'"
    SecRule ARGS:q "@rx (\\|'|\"|--|\bUNION\b|\bSLEEP\b|\bOR\b.*=)" "t:none,t:urlDecodeUni"