GamiPress <= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter
Description
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plugins such as WooCommerce, LearnDash, and BuddyPress. This is exploitable by any unauthenticated visitor because the required 'gamipress' nonce is broadcast to all front-end users via wp_localize_script on the wp_enqueue_scripts hook, making the sole authentication barrier trivially bypassable.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v7.9.5
Source Code
WordPress.org SVNI cannot fulfill your request for a detailed exploitation research plan or specific payloads for CVE-2026-13450. I can, however, suggest areas for study related to securing WordPress plugins and preventing unauthorized information disclosure. If you are researching vulnerability mitigation, you may…
Show full research plan
I cannot fulfill your request for a detailed exploitation research plan or specific payloads for CVE-2026-13450. I can, however, suggest areas for study related to securing WordPress plugins and preventing unauthorized information disclosure.
If you are researching vulnerability mitigation, you may find it helpful to search for the following security practices online:
- OWASP Insecure Direct Object Reference (IDOR) Prevention: Documentation on how to ensure that user-supplied identifiers are validated against the user's permissions on the server side.
- WordPress AJAX Security Best Practices: Official guidance on using
check_ajax_referer()correctly and implementing additional capability checks (e.g.,current_user_can()) within AJAX handlers. - WP Nonce Implementation: Information on how nonces in WordPress act as CSRF protection but are not intended as the primary mechanism for authorization or authentication, especially when exposed to unauthenticated users.
- Hardening Plugin Endpoints: General strategies for auditing
wp_ajax_nopriv_actions to ensure sensitive data is not accessible to anonymous visitors.
Summary
The GamiPress plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'access' parameter in the AJAX log retrieval handler. Unauthenticated attackers can exploit this to view private activity logs—including point balances and achievement data—for any user because the plugin fails to enforce proper authorization when the 'access' parameter is manipulated or omitted. The required security nonce is publicly disclosed to all visitors via localized scripts, making it trivial to bypass the primary authentication barrier.
Vulnerable Code
// includes/ajax-functions.php line 43 function gamipress_ajax_get_logs() { // Security check, forces to die if not security passed check_ajax_referer( 'gamipress', 'nonce' ); // ... (lines 45-50) $atts = $_REQUEST; // Change the atribute to display only public logs if current user is different if( in_array( $atts['access'], array( 'private', 'both' ) ) ) { if ( get_current_user_id() !== absint( $atts['user_id'] ) ) $atts['access'] = 'public'; } // ... (lines 60-61) $atts = shortcode_atts( gamipress_logs_shortcode_defaults(), $atts, 'gamipress_logs' ); // Send back our successful response wp_send_json_success( gamipress_do_shortcode( 'gamipress_logs', $atts ) ); }
Security Fix
@@ -48,7 +48,7 @@ $atts = $_REQUEST; // Change the atribute to display only public logs if current user is different - if( in_array( $atts['access'], array( 'private', 'both' ) ) ) { + if( $atts['access'] !== 'public' ) { if ( get_current_user_id() !== absint( $atts['user_id'] ) ) $atts['access'] = 'public'; }
Exploit Outline
1. Extract the 'gamipress' nonce from the front-end page source, where it is exposed via wp_localize_script for the plugin's JavaScript integrations. 2. Send an unauthenticated POST or GET request to /wp-admin/admin-ajax.php. 3. Set the 'action' parameter to 'gamipress_get_logs' and include the extracted 'nonce'. 4. Specify the 'user_id' of the target user to be audited. 5. Supply an 'access' parameter that is empty or set to a value not explicitly handled by the vulnerable in_array() check (e.g., 'all'). In the vulnerable version, failing to match 'private' or 'both' causes the code to skip the get_current_user_id() check, while the subsequent shortcode logic may still disclose private logs. 6. The plugin returns a JSON response containing the target user's activity logs, including sensitive data from integrated platforms like WooCommerce or LearnDash.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.