CVE-2023-24000
Published: 31 October 2023
Summary
CVE-2023-24000 is a high-severity SQL Injection (CWE-89) vulnerability in Gamipress Gamipress. Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 4.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-24000 is an unauthenticated SQL injection vulnerability (CWE-89) affecting the GamiPress WordPress plugin. It impacts all versions through 2.5.7 and carries a CVSS 3.1 score of 8.2, reflecting network-accessible attack vectors with no required authentication or user interaction.
An attacker can send specially crafted requests over the network to exploit the improper neutralization of SQL elements, enabling extraction of sensitive data with high confidentiality impact and limited effects on availability. The flaw resides in the plugin's handling of database queries, allowing remote adversaries to manipulate commands without credentials.
Patchstack advisories identify the issue as an unauthenticated SQL injection in GamiPress 2.5.7 and recommend applying vendor updates once released. The EPSS score reached a peak of 0.2422 with a current value of 0.2117, indicating moderate and relatively stable exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28064
Vulnerability details
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affects GamiPress: from n/a through 2.5.7.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.