CVE-2024-1799: 
WordPress vulnerability analysis and mitigation

The GamiPress WordPress plugin (versions up to and including 6.8.6) contains a SQL Injection vulnerability identified as CVE-2024-1799. The vulnerability exists in the 'achievement_types' attribute of the gamipress_earnings shortcode due to insufficient escaping of user-supplied parameters and inadequate SQL query preparation (NVD).

The vulnerability is classified as SQL Injection (CWE-89) with a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue stems from improper handling of the 'achievement_types' parameter in the gamipress_earnings shortcode, allowing authenticated users to manipulate SQL queries (NVD).

When exploited, this vulnerability allows authenticated attackers with contributor-level access or higher to append additional SQL queries to existing ones, potentially extracting sensitive information from the database (NVD).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The attacker can leverage the insufficient parameter escaping in the gamipress_earnings shortcode to perform SQL injection attacks (NVD).

Users should upgrade to GamiPress version 6.8.7 or later which contains the fix for this vulnerability (NVD).