WordPress plugin GamiPress SQL注入漏洞

🗓️ 22 Jan 2025 00:00:00Reported by China National Vulnerability Database of Information SecurityType

cnnvd

cnnvd🔗 www.cnnvd.org.cn👁 2 Views

SQL injection in WordPress plugin GamiPress up to version 7.2.1 from improper escaping of the orderby parameter.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-13496	21 Jan 202523:07	–	circl
CVE	CVE-2024-13496	22 Jan 202511:07	–	cve
Cvelist	CVE-2024-13496 GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter	22 Jan 202511:07	–	cvelist
Nuclei	GamiPress <= 2.8.9 - SQL Injection	11 Jun 202603:33	–	nuclei
NVD	CVE-2024-13496	22 Jan 202511:15	–	nvd
Patchstack	WordPress GamiPress plugin <= 7.2.1 - Unauthenticated SQL Injection via orderby Parameter vulnerability	21 Jan 202522:53	–	patchstack
RedhatCVE	CVE-2024-13496	4 Feb 202523:57	–	redhatcve
Vulnrichment	CVE-2024-13496 GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter	22 Jan 202511:07	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (January 20, 2025 to January 26, 2025)	30 Jan 202516:04	–	wordfence

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3226227/
plugins	www.plugins.trac.wordpress.org/browser/gamipress/trunk/includes/ajax-functions.php
wordpress	www.wordpress.org/plugins/gamipress/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ea54436c-b623-4049-af19-9995c312476e
abrahack	www.abrahack.com/posts/gamipress-sqli/
plugins	www.plugins.trac.wordpress.org/browser/gamipress/trunk/libraries/ct/includes/class-ct-query.php
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-13496
access	www.access.redhat.com/security/cve/cve-2024-13496

31 Dec 2025 00:00Current

9.1High risk

Vulners AI Score9.1

CVSS 3.17.5

EPSS0.19312

SSVC

WordPress GamiPress database injection orderby parameter version 7.2.1 prior versions