GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.6.3 - Missing Authorization
Description
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NTechnical Details
What Changed in the Fix
Changes introduced in v7.6.4
Source Code
WordPress.org SVNnonce` or `gamipress_ajax.nonce`. The shortcode `gamipress_logs` will likely trigger the script `gamipress-ajax`. Final check on the CVE Title: "Missing Authorization". Usually, for "Information Disclosure", they use that term. But if the "Action" is the AJAX call itself, "Missing Autho…
Show full research plan
nonceorgamipress_ajax.nonce. The shortcode gamipress_logswill likely trigger the scriptgamipress-ajax`.
Final check on the CVE Title: "Missing Authorization".
Usually, for "Information Disclosure", they use that term. But if the "Action" is the AJAX call itself, "Missing Authorization" fits.
Wait, I see one more thing. The CVSS Integrity is Low.
Is it possible to *delete* a log?
No, not via these functions.
Wait! What if I can use the `gamipress_get_logs` AJAX action to trigger a *different* shortcode?
The code says: `gamipress_do_shortcode( 'gamipress_logs', $atts )`.
This function is likely defined as:
`function gamipress_do_shortcode( $shortcode, $atts ) { return gamipress_..._shortcode( $atts ); }`
It's hardcoded to `gamipress_logs`.
Okay, the plan will focus on the unauthorized data access via shortcode attribute injection in the AJAX handlers.
- `action`: `gamipress_get_logs`
- `nonce`: `[extracted]`
- `user_id`: `1`
- `pagination`: `no`
This is the most solid path given the provided source code.
One final detail: `gamipress
Summary
The GamiPress plugin for WordPress is vulnerable to unauthorized information disclosure due to missing authorization checks in its AJAX handlers for logs and earnings. Unauthenticated or low-privileged attackers can exploit this by injecting shortcode attributes like 'user_id' and 'access' via AJAX requests, allowing them to view private activity logs of other users.
Vulnerable Code
// includes/ajax-functions.php, around line 46 function gamipress_ajax_get_logs() { // Security check, forces to die if not security passed check_ajax_referer( 'gamipress', 'nonce' ); // Set current page var if( isset( $_REQUEST['page'] ) && absint( $_REQUEST['page'] ) > 1 ) { set_query_var( 'paged', absint( $_REQUEST['page'] ) ); } $atts = $_REQUEST; // Unset non required shortcode atts unset( $atts['action'] ); unset( $atts['page'] ); // Sanitize foreach( $atts as $attr => $value ) { $atts[$attr] = sanitize_text_field( $value ); $atts[$attr] = str_replace( array( '[', ']' ), '', $value); } $atts = shortcode_atts( gamipress_logs_shortcode_defaults(), $atts, 'gamipress_logs' ); // Send back our successful response wp_send_json_success( gamipress_do_shortcode( 'gamipress_logs', $atts ) ); } add_action( 'wp_ajax_gamipress_get_logs', 'gamipress_ajax_get_logs' ); add_action( 'wp_ajax_nopriv_gamipress_get_logs', 'gamipress_ajax_get_logs' ); --- // includes/shortcodes/gamipress_logs.php, around line 185 function gamipress_logs_shortcode( $atts = array(), $content = '' ) { // ... (truncated) $atts = shortcode_atts( gamipress_logs_shortcode_defaults(), $atts, $shortcode ); // ... (truncated) if ( $atts['current_user'] === 'yes' ) { if ( ! is_user_logged_in() ) return ''; $atts['user_id'] = get_current_user_id(); } // Missing check to ensure current user has permission to see private logs of $atts['user_id']
Security Fix
@@ -3,7 +3,7 @@ * Plugin Name: GamiPress * Plugin URI: https://gamipress.com * Description: The most flexible and powerful gamification system for WordPress. - * Version: 7.6.3 + * Version: 7.6.4 * Author: GamiPress * Author URI: https://gamipress.com/ * Text Domain: gamipress @@ -121,7 +121,7 @@ private function constants() { // Plugin version - define( 'GAMIPRESS_VER', '7.6.3' ); + define( 'GAMIPRESS_VER', '7.6.4' ); // Plugin file define( 'GAMIPRESS_FILE', __FILE__ ); @@ -46,7 +46,13 @@ } $atts = $_REQUEST; - + + // Change the atribute to display only public logs if current user is different + if( in_array( $atts['access'], array( 'private', 'both' ) ) ) { + if ( get_current_user_id() !== absint( $atts['user_id'] ) ) + $atts['access'] = 'public'; + } + // Unset non required shortcode atts unset( $atts['action'] ); unset( $atts['page'] ); @@ -84,7 +90,7 @@ } $atts = $_REQUEST; - + // Unset non required shortcode atts unset( $atts['action'] ); unset( $atts['page'] ); @@ -193,6 +193,13 @@ return ''; $atts['user_id'] = get_current_user_id(); + + } + + // Change the atribute to display only public logs if current user is different + if( in_array( $atts['access'], array( 'private', 'both' ) ) ) { + if ( get_current_user_id() !== absint( $atts['user_id'] ) ) + $atts['access'] = 'public'; } // GamiPress template args global
Exploit Outline
To exploit this vulnerability, an attacker needs a valid GamiPress AJAX nonce (typically found in the `gamipress_ajax` JavaScript object on the frontend of a site where the plugin is active). The attacker then sends an AJAX request to `wp-admin/admin-ajax.php` with the action `gamipress_get_logs`. In the request, the attacker includes the `nonce`, sets the `user_id` parameter to the ID of the target user (e.g., 1 for the site administrator), and sets the `access` parameter to `private`. Because the plugin uses `$_REQUEST` to populate shortcode attributes without validating if the current requester is the owner of the logs, the server will return the rendered HTML containing the private logs of the targeted user. This works for unauthenticated users because the AJAX action is registered via `wp_ajax_nopriv`.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.