GamiPress EUVD-2026-100891

Requires only that the target WordPress site runs the GamiPress plugin at an affected version (7.9.5 up to, but not including, 8.0.6) with its activity-logging feature in use - no authentication, no user interaction, and no non-default configuration are needed (AV:N/AC:L/PR:N/UI:N). The vulnerability is the plugin's failure to authorize access to private activity-log entries, so the only prerequisite is that private activity logs exist to be retrieved. Limiting factors: sites on 8.0.6 or later are not affected, impact is read-only disclosure of activity-log data (no modification or availability loss), and the sensitivity of exposed data depends on how the site uses GamiPress activity tracking.

This is a genuine but moderate-priority issue. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates fully remote, unauthenticated, low-complexity access requiring no user interaction, and publicly available exploit code exists (per WPScan), which lowers the barrier to opportunistic abuse. These signals align with the SSVC assessment of Automatable:yes and Technical Impact:partial. However, several signals temper the urgency: EPSS is low at 0.19% (8th percentile), SSVC Exploitation is 'none', and there is no CISA KEV listing - so there is no evidence of active exploitation, only a public PoC. Impact is confined to confidentiality (C:L, I:N, A:N): the flaw leaks private activity-log entries, not credentials or write access. The signals are internally consistent - easy to exploit and automatable, but limited blast radius and no confirmed in-the-wild use. The notable risk amplifier is that this is explicitly an incomplete fix of CVE-2026-13450, meaning the vulnerability class was already known and patched once; attackers aware of the prior CVE may readily adapt existing tooling, which realistically elevates exploitation likelihood above what the raw EPSS suggests.

An unauthenticated attacker sends crafted HTTP requests to a GamiPress-enabled WordPress site (version 7.9.5 through below 8.0.6) and retrieves the private activity logs of all users without needing any account or credentials. A public exploit is available via WPScan, and because the issue is an incomplete fix of CVE-2026-13450, attackers can likely reuse or lightly modify prior tooling. The leaked logs may expose user behavior, gamification activity, and other private metadata usable for profiling or follow-on social engineering.