EUVD-2026-69836
GHSA-g62j-5jwq-v4mf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible via HTTP, low-privilege Subscriber account required, no user interaction needed, integrity impact limited to gamification data only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.
AnalysisAI
Insufficient access control in GamiPress (WordPress plugin before 7.9.9.6) allows any authenticated Subscriber-level user to abuse the video watch-tracking endpoint to award configured gamification points, achievements, and ranks to any WordPress user on the site - including administrators - and to accrue them without limit. The flaw maps to CWE-639 (Authorization Bypass Through User-Controlled Key), where the endpoint accepts a user-controlled target identifier without verifying the requester's authorization to grant rewards to that target. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user with at minimum the Subscriber role - the lowest non-anonymous role in WordPress, granted to any registered site user. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 4.3 score with I:L accurately reflects that the direct data impact is limited to gamification records rather than system integrity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update GamiPress to version 7.9.9.6 or later, available through the WordPress plugin repository; this is the primary fix confirmed by the vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in Ruben Garcia GamiPress gamipress.5.7. Rated high severity (CVSS 8.2), this vulnerability is remotely
The GamiPress - Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is
The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings
The The GamiPress - The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for Wo
The GamiPress WordPress plugin before 1.0.9 does not validate and escape some of its shortcode attributes before outputt
Unauthenticated SQL injection in the Gamipress WordPress plugin (versions up to 7.9.7) allows remote attackers to execut
The GamiPress - The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPr
SQL injection in the GamiPress WordPress plugin versions 7.8.7 and earlier allows authenticated users with subscriber-le
The GamiPress - Link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gamipress_link s
The GamiPress - The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPr
The GamiPress - Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gamipress_but
Missing Authorization vulnerability in GamiPress GamiPress - The #1 gamification plugin to reward points, achievements,
Share
External POC / Exploit Code
Leaving vuln.today