What is the CVSS score of CVE-2026-32420?

CVE-2026-32420 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Gamipress are affected by CVE-2026-32420?

CVE-2026-32420 presents moderate security risk, a cross-site request forgery vulnerability rated CVSS 5.4. Users could be tricked into performing unintended actions.

How to fix or mitigate CVE-2026-32420?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Gamipress CVE-2026-32420

EUVD-2026-11945 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-13 Patchstack

WordPress CSRF Gamipress Wordpress Plugin Ruben Garcia

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11945

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.4

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in Ruben Garcia GamiPress gamipress allows Cross Site Request Forgery.This issue affects GamiPress: from n/a through <= 7.6.6.

AnalysisAI

GamiPress versions 7.6.6 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthenticated attackers to perform unauthorized actions on behalf of authenticated users through maliciously crafted requests. An attacker can exploit this to modify plugin settings, create or delete gamification elements, or alter user data without the target user's knowledge or consent. The vulnerability requires user interaction (clicking a malicious link) but has no authentication requirement for the attack itself, making it a moderate-risk issue suitable for opportunistic exploitation against WordPress administrators.

Technical ContextAI

The vulnerability exists in the GamiPress WordPress plugin (CPE identifier cpe:2.3:a:ruben_garcia:gamipress), which is a gamification framework for WordPress. GamiPress is classified as CWE-352 (Cross-Site Request Forgery), indicating that the plugin fails to implement proper CSRF tokens (nonces in WordPress terminology) on sensitive state-changing operations such as achievement creation, badge assignment, or leaderboard configuration. The root cause is insufficient validation of the origin of requests combined with missing or improperly validated anti-CSRF tokens. WordPress provides the nonce mechanism specifically for this purpose, and GamiPress appears to have missed protecting certain administrative and user-facing functions with these tokens. The attack exploits the inherent trust browsers place in same-origin requests, allowing cross-site malicious forms or scripts to trigger plugin actions.

RemediationAI

Immediately upgrade GamiPress to version 7.6.7 or later, which should contain the necessary CSRF token validation fixes. This upgrade is the definitive remediation and should be applied without delay via the WordPress plugin update mechanism. Until patching is feasible, implement the following mitigations: restrict administrative access to GamiPress settings to trusted internal networks only using a reverse proxy or .htaccess rules; disable direct access to GamiPress admin pages from the public internet; educate site administrators to avoid clicking suspicious links while logged in; and consider temporarily disabling the GamiPress plugin if it is not actively in use. Verify the patch via the official GamiPress repository and security advisory (https://github.com/rubengc/gamipress or https://wordpress.org/plugins/gamipress/) before deployment.