nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-24000 CVE-2023-24000
HIGHNuclei
WordPress GamiPress Plugin <= 2.5.7 is vulnerable to SQL Injection
Record summary
CVE-2023-24000 has a selected CVSS score of 8.2 (high); EIP currently links 1 Nuclei template.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Apr 1, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 6, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
GamiPressBrowse GamiPress / GamiPressDefault status: unaffected | CVE List | Through 2.5.7 | affected |
gamipressBrowse gamipress / gamipressDefault status: unknown | CVE List, VulnCheck | Through 2.5.7 | affected |
Nuclei templates
1ProjectDiscoveryCRITICALWordPress GamiPress <= 2.5.7 - SQL InjectionCVSS 9.8
The GamiPress plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.5.7 due to insufficient escaping on the user supplied parameter '$qv[$field_id]' and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Impact
Attackers can execute arbitrary SQL commands, potentially leading to data theft, data tampering, or database compromise.
Remediation
Update to the latest version of GamiPress, version 2.5.8 or later.
WeaknessesCWE-89
AuthorsShivam Kamboj
Template tagscvecve2023wordpresswp-plugingamipresssqliwpvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
FOFA: body="/wp-content/plugins/gamipress/"
Source: ProjectDiscovery
References
3patchstack.com
https://patchstack.com/database/Wordpress/Plugin/gamipress/vulnerability/wordpress-gamipress-plugin-2-5-7-unauthenticated-sql-injection-vulnerability?_s_id=cve patchstack.comvdb entry
https://patchstack.com/database/vulnerability/gamipress/wordpress-gamipress-plugin-2-5-7-unauthenticated-sql-injection-vulnerability?_s_id=cve