CVE-2026-15439 describes an authenticated SQL Injection vulnerability in the GamiPress plugin for WordPress, affecting versions up to and including 7.9.7. The vulnerability exists in the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts). Input is sanitized only with $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause without using %s placeholders in $wpdb->prepare(). Due to WordPress core magic quotes and the behavior of esc_like(), an attacker can inject SQL by breaking out of the string context, enabling boolean-based SQL injection. Exploitation requires a Subscriber account and the wpForo plugin to be active, but no vulnerabilities in wpForo itself are exploited. The vulnerability does not affect Simple:Press integration, which uses proper $wpdb->prepare() calls.

An authenticated user with Subscriber privileges can perform SQL Injection attacks against the WordPress database via the vulnerable 'q' parameter. This can lead to unauthorized data disclosure (confidentiality impact) without affecting integrity or availability. The vulnerability allows reading sensitive information such as the gamipress_admin nonce, which is exposed on admin pages. There is no indication of remote unauthenticated exploitation or active exploitation in the wild.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Subscriber-level access where possible and monitor for updates from the vendor. Avoid enabling the wpForo integration if not required. Do not rely on the wpForo plugin being secure as it is not the source of the vulnerability.