An unauthenticated blind SQL injection flaw exists in the GamiPress plugin for WordPress versions up to 8.0.2. The vulnerability arises from improper neutralization of special elements used in SQL commands, allowing an attacker to inject and execute arbitrary SQL statements through the plugin. This can result in reading, modifying, or deleting database contents. The weakness aligns with CWE-89.

The affected product is the WordPress GamiPress plugin developed by Ruben Garcia. Version numbers up to and including 8.0.2 are vulnerable; any installation using these versions of the plugin or earlier is at risk.

The CVSS score of 8.5 indicates a high severity impact. The EPSS score of 0.0026 indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation may not yet be reported. Because the flaw is unauthenticated, an attacker only needs to send a crafted request to the plugin’s endpoints from any network location, making exploitation technically straightforward once the correct input vectors are identified.