The vulnerability is an SQL injection flaw introduced by improper neutralization of special elements in SQL commands within the GamiPress plugin. It allows an attacker to inject arbitrary SQL statements, potentially reading, modifying or deleting sensitive data stored in the WordPress database. This manifests the weakness identified as CWE‑89 and can be exploited to disrupt confidentiality and integrity of user data.

The issue impacts WordPress sites running the GamiPress plugin from the earliest release up to and including version 7.4.5. Sites that still use these affected releases are at risk; newer releases are not affected.

With a CVSS score of 7.6 the vulnerability is considered high severity. The EPSS score is reported as less than 1%, indicating that the likelihood of exploitation is currently low, and it is not listed in the CISA KEV catalog. The likely attack vector is remote, via HTTP requests that the plugin processes. An attacker would need to craft inputs that reach the vulnerable code paths, which are typically exposed through public plugin pages. Provided the WordPress site is reachable over the internet, the exploitation conditions are realistic.