What is the CVSS score of CVE-2026-24546?

CVE-2026-24546 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

GamiPress CVE-2026-24546

EUVD-2026-31723 MEDIUM

Missing Authorization (CWE-862)

2026-05-25 Patchstack

GHSA-5v8g-2w9g-6cwm

WordPress Authentication Bypass Gamipress Wordpress Plugin Ruben Garcia

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:47 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Ruben Garcia GamiPress allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects GamiPress: from n/a through 7.6.3.

AnalysisAI

Unauthenticated information disclosure in the GamiPress WordPress plugin (versions through 7.6.3) allows remote attackers to read restricted data by exploiting missing authorization checks on plugin endpoints. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required, though impact is limited to low confidentiality exposure with no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis, and an EPSS score of 0.03% (8th percentile) reflects low real-world exploitation probability.

Technical ContextAI

GamiPress is a WordPress gamification plugin developed by Ruben Garcia, identified by CPE cpe:2.3:a:ruben_garcia:gamipress:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of vulnerability where server-side code executes a sensitive function or returns restricted data without verifying whether the requesting user holds the required permission or role. In the WordPress plugin ecosystem, this commonly manifests as REST API endpoints, AJAX handlers (wp_ajax_nopriv_ hooks), or shortcode-driven data retrieval that omit capability checks such as current_user_can(). The tag 'Authentication Bypass' corroborates that access-controlled data or functionality is reachable without any identity verification, consistent with the PR:N designation in the CVSS vector.

RemediationAI

The primary remediation is to update the GamiPress plugin beyond version 7.6.3; however, the exact patched release version is not confirmed from the available input data - the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-6-3-broken-access-control-vulnerability should be consulted to verify the minimum safe version before updating. Until a patch is applied, site administrators can partially mitigate risk by restricting access to WordPress AJAX and REST API endpoints at the web server or WAF layer for unauthenticated users, though this may break legitimate plugin functionality such as public-facing points displays or leaderboards. A WordPress security plugin (e.g., Wordfence, Patchstack Shield) with virtual patching rules for this CVE can serve as a temporary compensating control without requiring plugin deactivation. Disabling the GamiPress plugin entirely eliminates exposure at the cost of all gamification functionality.