CVE-2026-112837: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Ruben Garcia GamiPress

The vulnerability identified as CVE-2026-112837 in the GamiPress plugin involves improper neutralization of special elements in SQL commands, enabling blind SQL injection attacks. This flaw allows an attacker with low privileges and no user interaction to exploit the vulnerability remotely over the network. The impact includes a high confidentiality breach and a low availability impact. The affected versions include all releases before 8.0.8.

Successful exploitation can lead to unauthorized disclosure of sensitive information (high confidentiality impact) and may cause limited disruption to service availability (low availability impact). Integrity is not impacted according to the CVSS vector. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's announcements for updates. Until a fix is available, consider restricting access to the affected plugin and limiting privileges of users who can interact with it.