GamiPress EUVD-2026-100890

Requires a valid authenticated WordPress account on the target site - any role suffices, including the lowest-privilege Subscriber (per CVSS PR:L), which is readily obtainable where open user registration is enabled. The specific trigger is one GamiPress authenticated AJAX action that lacks both a capability check and ownership verification; no special plugin configuration, user interaction, or administrative privilege is needed, and default installations are affected on GamiPress versions before 8.0.6. Limiting factors: exploitation is impossible without an authenticated session (so sites that disable self-registration raise the bar to needing credentials), impact is read-only disclosure of activity-log data (no write/modify or service impact), and the sensitivity of exposed data depends on how the site uses GamiPress activity logging.

This is a genuine but low-to-moderate priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 MEDIUM) describes a network-reachable, low-complexity information disclosure that requires an authenticated low-privilege account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability effect - matching the description of an IDOR/broken-authorization flaw (CWE-639) in an authenticated AJAX action. The exploitation signals reinforce a low real-world urgency: EPSS is 0.17% (6th percentile), there is NO CISA KEV listing (not actively exploited), and CISA SSVC scores Exploitation=none, Automatable=no, Technical Impact=partial. The one escalating signal is that WPScan reports publicly available exploit code, but POC availability is distinct from active exploitation and does not by itself raise this to emergency status. Net: this is a real, patchable data-exposure bug worth remediating on a normal cycle, not a high-CVSS-but-illusory issue, but also not a drop-everything priority - the low EPSS, absence of KEV, SSVC 'Automatable: no', and the requirement for a valid (even if low-privilege) account all cap realistic risk. The main caveat is that impact depends on what the activity log contains (other users' point balances, achievements, and administrator usernames tied to manual awards), so sensitivity is site-dependent.

An attacker registers or already holds a low-privilege WordPress account (e.g., Subscriber) on a site running GamiPress before 8.0.6, then invokes the vulnerable authenticated AJAX action directly, supplying identifiers for entries they do not own. Because no capability check or ownership verification is performed, the server returns arbitrary activity-log entries, leaking other users' point balances, earned achievements, and the usernames of administrators who performed manual point awards/revocations. Publicly available exploit code (WPScan) lowers the effort required, though exploitation still needs a valid authenticated session.