CVE-2026-121792

Name of the Vulnerable Software and Affected Versions GamiPress versions prior to 8.1.2

Description An issue exists where authenticated attackers with subscriber-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied parameters and a lack of sufficient preparation on the existing SQL query. The flaw is triggered via the input <field id>.<part> parameter, specifically affecting Gravity Forms name-field parts or list-field rows. Successful exploitation allows attackers to append additional SQL queries to extract sensitive information from the database. This requires a GamiPress achievement to be configured against a Gravity Forms 'field value submission' event with the corresponding form published.

Recommendations Update GamiPress to version 8.1.2 or later.