EUVD-2026-42540
GHSA-hcgf-cxhm-8vcm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible AJAX endpoint with publicly broadcast nonce removes all authentication barriers; impact is limited to partial confidentiality disclosure with no integrity or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The GamiPress - Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plugins such as WooCommerce, LearnDash, and BuddyPress. This is exploitable by any unauthenticated visitor because the required 'gamipress' nonce is broadcast to all front-end users via wp_localize_script on the wp_enqueue_scripts hook, making the sole authentication barrier trivially bypassable.
AnalysisAI
Unauthenticated information disclosure in the GamiPress WordPress plugin (all versions through 7.9.4) allows any site visitor to read private activity log entries belonging to arbitrary users, including badge earnings, points balance changes, WooCommerce purchase events, LearnDash course completions, and BuddyPress activity records. The IDOR flaw in the 'access' parameter is rendered trivially exploitable because the sole authentication gate - a gamipress nonce - is deliberately broadcast to every front-end visitor via wp_localize_script, meaning no credential or privilege is required beyond loading any page on the target site. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the near-zero exploitation complexity makes it a practical mass-exploitation candidate against any unpatched deployment.
Technical ContextAI
CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the plugin resolves which user's activity log to return based on an attacker-controllable 'access' parameter without verifying that the requestor is authorized to view that log. The vulnerable AJAX handler is in includes/ajax-functions.php (lines 48, 51, and 73 in both the 7.8.6 and 7.9.3 SVN tags), and the shortcode rendering path exposes the same logic at includes/shortcodes/gamipress_logs.php (lines 272 and 329). The nonce issued as 'gamipress' is registered and exposed to the browser via wp_localize_script inside the wp_enqueue_scripts hook (includes/scripts.php line 51), a standard WordPress mechanism for passing PHP values to JavaScript - meaning every anonymous visitor already receives a valid nonce on page load, defeating nonce-as-authentication entirely. The affected CPE is cpe:2.3:a:rubengc:gamipress_-_gamification_plugin_to_reward_points,_achievements,_badges_&_ranks_in_wordpress:*:*:*:*:*:*:*:*
RemediationAI
Upgrade the GamiPress plugin to a version beyond 7.9.4 once a patched release is published to WordPress.org; an upstream fix has been committed in SVN changeset 3593749 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3593749%40gamipress&new=3593749%40gamipress), but a released patched version number is not independently confirmed from the available data - monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/3006261b-a09e-4cff-b49f-49e992c6fe0b for confirmation. As an interim compensating control, administrators can block unauthenticated POST requests targeting the wp_ajax_nopriv_ actions used by GamiPress via WAF rules (e.g., block requests to admin-ajax.php containing GamiPress-specific action values) - this reduces exposure but may affect legitimate logged-out user interactions and requires testing. Deactivating the plugin entirely eliminates the attack surface at the cost of all gamification functionality. Removing gamipress_logs shortcodes from public pages reduces information leakage via the shortcode path but does not patch the underlying AJAX handler vulnerability.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today