Threats tagged 'ghsa-hqr2-crpr-hr2j'

The GamiPress WordPress plugin, used for gamification with points, badges, and ranks, contains a SQL Injection vulnerability in all versions up to and including 8.1.1. This flaw arises from insufficient escaping of user-supplied input in the 'input_<field_id>.<part>' parameter related to Gravity Forms integration. Authenticated users with subscriber-level access or higher can exploit this to append SQL queries and extract sensitive database information. Exploitation requires a configured GamiPress achievement tied to a Gravity Forms field value submission event with the form published.