CVE-2026-59538: GamiPress SQLi Vulnerability

CVE-2026-59538 Overview

CVE-2026-59538 is an unauthenticated SQL injection vulnerability affecting the GamiPress WordPress plugin in versions up to and including 7.9.7. The flaw is tracked under CWE-89 and allows remote attackers to inject arbitrary SQL statements without authentication. Attackers reaching the vulnerable endpoint over the network can manipulate database queries executed by the plugin. According to Patchstack, the issue was confirmed against GamiPress 7.9.7 and earlier releases.

Critical Impact
Unauthenticated attackers can inject SQL into GamiPress database queries, exposing WordPress site data and enabling downstream site compromise.

Affected Products

GamiPress plugin for WordPress, versions <= 7.9.7
WordPress sites running the vulnerable GamiPress release
Any site exposing the GamiPress endpoints to unauthenticated network traffic

Discovery Timeline

2026-07-27 - CVE-2026-59538 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-59538

Vulnerability Analysis

CVE-2026-59538 is a SQL injection vulnerability in the GamiPress WordPress plugin. The plugin passes attacker-controlled input into a SQL query without proper sanitization or parameterization. The weakness maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

The issue is exploitable over the network with no authentication and no user interaction. Successful exploitation lets an attacker read data from the WordPress database, including tables outside the plugin's scope. The scope change reflected in the CVSS vector indicates the injected query can reach resources beyond the vulnerable component. The EPSS probability at publication is 0.236%, placing it in the 14.787 percentile of published CVEs.

Root Cause

The root cause is missing input validation and unsafe query construction inside GamiPress request handlers. User-supplied parameters are concatenated into SQL statements executed against the WordPress $wpdb database interface. Without prepared statements or strict type casting, the parser treats attacker-controlled fragments as SQL syntax rather than data.

Attack Vector

Exploitation requires only network access to a WordPress site running GamiPress <= 7.9.7. An attacker sends a crafted HTTP request containing SQL metacharacters in a vulnerable parameter. The plugin processes the request as an unauthenticated user and executes the tampered query. Depending on the injected payload, the attacker can extract data using UNION-based reads, boolean-based inference, or time-based blind techniques. Refer to the Patchstack advisory for endpoint-specific technical details.

Detection Methods for CVE-2026-59538

Indicators of Compromise

HTTP requests to GamiPress endpoints containing SQL metacharacters such as UNION SELECT, SLEEP(, OR 1=1, or encoded variants like %27
Unexpected wpdb query errors in WordPress debug.log referencing GamiPress handlers
Anomalous outbound responses with unusually large payloads from GamiPress URLs
New or modified WordPress administrator accounts following suspicious GamiPress traffic

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection patterns targeting GamiPress request parameters
Enable MySQL general query logging temporarily to identify malformed queries originating from the plugin
Correlate WordPress access logs with database error logs for unauthenticated requests to plugin routes

Monitoring Recommendations

Alert on unauthenticated POST or GET traffic to GamiPress AJAX and REST endpoints with encoded SQL syntax
Monitor for repeated time-delayed responses that indicate blind SQL injection probing
Track database read volumes against baseline for the WordPress user account used by wp-config.php

How to Mitigate CVE-2026-59538

Immediate Actions Required

Update GamiPress to a fixed release above 7.9.7 as published by the vendor on the Patchstack advisory
Audit WordPress user accounts and reset credentials if suspicious GamiPress traffic is present in logs
Restrict access to WordPress admin and plugin endpoints behind a WAF or IP allowlist while patching

Patch Information

Upgrade GamiPress to the version released after 7.9.7 that addresses this SQL injection. Consult the Patchstack vulnerability record for the exact fixed version. Apply the update through the WordPress dashboard or wp-cli and verify the installed version afterward.

Workarounds

Disable and remove the GamiPress plugin until an upgrade can be applied
Deploy virtual patching via a WAF rule that blocks SQL metacharacters on GamiPress request paths
Enforce least privilege on the database user configured in wp-config.php to limit blast radius

bash

# Configuration example
wp plugin update gamipress
wp plugin get gamipress --field=version