An instance of Improper Neutralization of Special Elements used in an SQL Command, which permits blind SQL injection against the GamiPress plugin, and is classified as CWE‑89. The CVE notes that this flaw allows an attacker to supply crafted SQL through the plugin, though the exact effect on the database content is not described in the CVE. Based on the description, it is inferred that an attacker could potentially query, modify, or delete data.

Ruben Garcia’s GamiPress WordPress plugin is impacted for all releases up to and including 8.0.7. Users running these versions, regardless of deployment size, are susceptible to exploitation.

The CVSS score of 8.5 classifies this flaw as high severity. No EPSS value is available, so the probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploits. The CVE does not detail the attack vector, but it is inferred that it involves web-based input that reaches the plugin’s database query layer. The CVE does not describe the specific consequences beyond allowing blind SQL injection.