[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDblAnOo0jwb1flvmYxgRuHKVousqK250R-GO6WavoJA":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":30,"research_vulnerable_code":31,"research_fix_diff":32,"research_exploit_outline":33,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":37},"CVE-2026-24546","gamipress-gamification-plugin-to-reward-points-achievements-badges-ranks-in-wordpress-missing-authorization","GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress \u003C= 7.6.3 - Missing Authorization","The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.","gamipress",null,"\u003C=7.6.3","7.6.4","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-05-25 00:00:00","2026-05-26 19:14:05",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff9f5aa00-58d3-4b22-af15-1dfd1d70690b?source=api-prod",2,[22,23,24,25],"gamipress.php","includes\u002Fajax-functions.php","includes\u002Fshortcodes\u002Fgamipress_logs.php","readme.txt","researched",false,3,"nonce` or `gamipress_ajax.nonce`.\n    The shortcode `gamipress_logs` will likely trigger the script `gamipress-ajax`.\n\n    Final check on the CVE Title: \"Missing Authorization\".\n    Usually, for \"Information Disclosure\", they use that term. But if the \"Action\" is the AJAX call itself, \"Missing Authorization\" fits.\n\n    Wait, I see one more thing. The CVSS Integrity is Low.\n    Is it possible to *delete* a log?\n    No, not via these functions.\n    Wait! What if I can use the `gamipress_get_logs` AJAX action to trigger a *different* shortcode?\n    The code says: `gamipress_do_shortcode( 'gamipress_logs', $atts )`.\n    This function is likely defined as:\n    `function gamipress_do_shortcode( $shortcode, $atts ) { return gamipress_..._shortcode( $atts ); }`\n    It's hardcoded to `gamipress_logs`.\n\n    Okay, the plan will focus on the unauthorized data access via shortcode attribute injection in the AJAX handlers.\n\n    - `action`: `gamipress_get_logs`\n    - `nonce`: `[extracted]`\n    - `user_id`: `1`\n    - `pagination`: `no`\n\n    This is the most solid path given the provided source code.\n\n    One final detail: `gamipress","The GamiPress plugin for WordPress is vulnerable to unauthorized information disclosure due to missing authorization checks in its AJAX handlers for logs and earnings. Unauthenticated or low-privileged attackers can exploit this by injecting shortcode attributes like 'user_id' and 'access' via AJAX requests, allowing them to view private activity logs of other users.","\u002F\u002F includes\u002Fajax-functions.php, around line 46\nfunction gamipress_ajax_get_logs() {\n    \u002F\u002F Security check, forces to die if not security passed\n    check_ajax_referer( 'gamipress', 'nonce' );\n\n\t\u002F\u002F Set current page var\n    if( isset( $_REQUEST['page'] ) && absint( $_REQUEST['page'] ) > 1 ) {\n        set_query_var( 'paged', absint( $_REQUEST['page'] ) );\n    }\n\n    $atts = $_REQUEST;\n\n    \u002F\u002F Unset non required shortcode atts\n    unset( $atts['action'] );\n    unset( $atts['page'] );\n\n\t\u002F\u002F Sanitize\n    foreach( $atts as $attr => $value ) {\n        $atts[$attr] = sanitize_text_field( $value );\n\t\t$atts[$attr] = str_replace( array( '[', ']' ), '', $value);\n    }\n\n\t$atts = shortcode_atts( gamipress_logs_shortcode_defaults(), $atts, 'gamipress_logs' );\n\n\t\u002F\u002F Send back our successful response\n\twp_send_json_success( gamipress_do_shortcode( 'gamipress_logs', $atts ) );\n\n}\nadd_action( 'wp_ajax_gamipress_get_logs', 'gamipress_ajax_get_logs' );\nadd_action( 'wp_ajax_nopriv_gamipress_get_logs', 'gamipress_ajax_get_logs' );\n\n---\n\n\u002F\u002F includes\u002Fshortcodes\u002Fgamipress_logs.php, around line 185\nfunction gamipress_logs_shortcode( $atts = array(), $content = '' ) {\n    \u002F\u002F ... (truncated)\n    $atts = shortcode_atts( gamipress_logs_shortcode_defaults(), $atts, $shortcode );\n\n    \u002F\u002F ... (truncated)\n    if ( $atts['current_user'] === 'yes' ) {\n\n        if ( ! is_user_logged_in() )\n            return '';\n\n        $atts['user_id'] = get_current_user_id();\n    }\n\n    \u002F\u002F Missing check to ensure current user has permission to see private logs of $atts['user_id']","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.3\u002Fgamipress.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.4\u002Fgamipress.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.3\u002Fgamipress.php\t2026-01-13 12:52:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.4\u002Fgamipress.php\t2026-01-20 12:39:54.000000000 +0000\n@@ -3,7 +3,7 @@\n  * Plugin Name:     \tGamiPress\n  * Plugin URI:      \thttps:\u002F\u002Fgamipress.com\n  * Description:     \tThe most flexible and powerful gamification system for WordPress.\n- * Version:         \t7.6.3\n+ * Version:         \t7.6.4\n  * Author:          \tGamiPress\n  * Author URI:      \thttps:\u002F\u002Fgamipress.com\u002F\n  * Text Domain:     \tgamipress\n@@ -121,7 +121,7 @@\n \tprivate function constants() {\n \n \t\t\u002F\u002F Plugin version\n-\t\tdefine( 'GAMIPRESS_VER', '7.6.3' );\n+\t\tdefine( 'GAMIPRESS_VER', '7.6.4' );\n \n \t\t\u002F\u002F Plugin file\n \t\tdefine( 'GAMIPRESS_FILE', __FILE__ );\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.3\u002Fincludes\u002Fajax-functions.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.4\u002Fincludes\u002Fajax-functions.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.3\u002Fincludes\u002Fajax-functions.php\t2026-01-13 12:52:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.4\u002Fincludes\u002Fajax-functions.php\t2026-01-20 12:39:54.000000000 +0000\n@@ -46,7 +46,13 @@\n     }\n \n     $atts = $_REQUEST;\n-\n+    \n+\t\u002F\u002F Change the atribute to display only public logs if current user is different\n+    if( in_array( $atts['access'], array( 'private', 'both' ) ) ) {\n+        if ( get_current_user_id() !== absint( $atts['user_id'] ) )\n+            $atts['access'] = 'public';\n+    }\n+\t\n     \u002F\u002F Unset non required shortcode atts\n     unset( $atts['action'] );\n     unset( $atts['page'] );\n@@ -84,7 +90,7 @@\n     }\n \n     $atts = $_REQUEST;\n-\n+    \n     \u002F\u002F Unset non required shortcode atts\n     unset( $atts['action'] );\n     unset( $atts['page'] );\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.3\u002Fincludes\u002Fshortcodes\u002Fgamipress_logs.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.4\u002Fincludes\u002Fshortcodes\u002Fgamipress_logs.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.3\u002Fincludes\u002Fshortcodes\u002Fgamipress_logs.php\t2026-01-13 12:52:54.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.6.4\u002Fincludes\u002Fshortcodes\u002Fgamipress_logs.php\t2026-01-20 12:39:54.000000000 +0000\n@@ -193,6 +193,13 @@\n             return '';\n \n         $atts['user_id'] = get_current_user_id();\n+\n+    }\n+\n+    \u002F\u002F Change the atribute to display only public logs if current user is different\n+    if( in_array( $atts['access'], array( 'private', 'both' ) ) ) {\n+        if ( get_current_user_id() !== absint( $atts['user_id'] ) )\n+            $atts['access'] = 'public';\n     }\n \n     \u002F\u002F GamiPress template args global","To exploit this vulnerability, an attacker needs a valid GamiPress AJAX nonce (typically found in the `gamipress_ajax` JavaScript object on the frontend of a site where the plugin is active). The attacker then sends an AJAX request to `wp-admin\u002Fadmin-ajax.php` with the action `gamipress_get_logs`. In the request, the attacker includes the `nonce`, sets the `user_id` parameter to the ID of the target user (e.g., 1 for the site administrator), and sets the `access` parameter to `private`. Because the plugin uses `$_REQUEST` to populate shortcode attributes without validating if the current requester is the owner of the logs, the server will return the rendered HTML containing the private logs of the targeted user. This works for unauthenticated users because the AJAX action is registered via `wp_ajax_nopriv`.","gemini-3-flash-preview","2026-06-04 21:14:03","2026-06-04 21:14:58",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","7.6.3","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgamipress\u002Ftags\u002F7.6.3","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgamipress.7.6.3.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgamipress\u002Ftags\u002F7.6.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgamipress.7.6.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgamipress\u002Ftags"]