This vulnerability (CVE-2025-49326) in Ruben Garcia's GamiPress plugin allows SQL Injection due to improper neutralization of special elements in SQL commands. It affects all versions up to 7.4.5. The CVSS 3.1 score is 7.6, indicating a high severity with network attack vector, low attack complexity, requiring high privileges, no user interaction, and a scope change. The impact includes high confidentiality loss and low availability impact, with no integrity impact. No patch or vendor advisory is currently provided.

An attacker with high privileges can exploit this SQL Injection vulnerability to execute unauthorized SQL commands, potentially leading to disclosure of sensitive data (confidentiality impact is high) and limited denial of service (availability impact is low). Integrity is not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict high privilege access to the GamiPress plugin and monitor for unusual database activity. Avoid exposing the affected versions publicly where possible.