CVE-2026-59538: Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions.

Details

Source

NVD Recent CVEs (US · database · site)

Severity

critical — CVSS 9.3

Published

2026-07-27

Last updated

2026-07-27

Exploitation

Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59538

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-595380.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all scored CVEs.

Referenced CVEs

Recent advisories for Unauthenticated SQL Injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• unknownCVE-2026-65890: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple …nvd · 2026-07-29
• criticalCVE-2026-63230: A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthe…nvd · 2026-07-29
• criticalCVE-2026-63229: A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticat…nvd · 2026-07-29
• criticalCVE-2026-59550: Unauthenticated SQL Injection in AWP Classifieds <= 4.4.7 versions.nvd · 2026-07-27
• criticalCVE-2026-59549: Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versi…nvd · 2026-07-27
• criticalCVE-2026-59533: Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.nvd · 2026-07-27

More from NVD Recent CVEs

• mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
• mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
• mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
• highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
• mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01