This vulnerability (CVE-2026-94177) is an improper neutralization of special elements used in an SQL command (CWE-89) in the GamiPress plugin by Ruben Garcia. It affects all versions up to and including 8.0.2. The flaw allows unauthenticated attackers with low privileges to inject SQL commands, which can lead to significant confidentiality breaches and limited availability impact. The CVSS 3.1 base score is 8.5, indicating a high severity issue with network attack vector, low attack complexity, no user interaction, and scope changed. No vendor advisory or patch information is available at this time.

The vulnerability allows unauthenticated SQL injection attacks that can compromise the confidentiality of the database, potentially exposing sensitive data. Integrity is not impacted, but availability may be slightly affected. The attack requires low privileges and no user interaction, making it relatively easy to exploit remotely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider restricting access to vulnerable endpoints and monitoring for suspicious activity related to SQL injection attempts.