[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-fLFlQYgL11TwBkvrk5uRLYbTJGJzwMQ1E2QUdodbMo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-13450","gamipress-insecure-direct-object-reference-to-unauthenticated-sensitive-information-disclosure-via-access-parameter","GamiPress \u003C= 7.9.4 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'access' Parameter","The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plugins such as WooCommerce, LearnDash, and BuddyPress. This is exploitable by any unauthenticated visitor because the required 'gamipress' nonce is broadcast to all front-end users via wp_localize_script on the wp_enqueue_scripts hook, making the sole authentication barrier trivially bypassable.","gamipress",null,"\u003C=7.9.4","7.9.5","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N","Authorization Bypass Through User-Controlled Key","2026-07-08 19:22:27","2026-07-09 07:55:12",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F3006261b-a09e-4cff-b49f-49e992c6fe0b?source=api-prod",1,[22,23,24,25,26,27,28,29],"gamipress.php","includes\u002Fajax-functions.php","integrations\u002Fvimeo\u002Fassets\u002Fjs\u002Fgamipress-vimeo.js","integrations\u002Fvimeo\u002Fassets\u002Fjs\u002Fgamipress-vimeo.min.js","integrations\u002Fvimeo\u002Fincludes\u002Ffunctions.php","integrations\u002Fvimeo\u002Fincludes\u002Flisteners.php","integrations\u002Fvimeo\u002Fincludes\u002Fscripts.php","integrations\u002Fvimeo\u002Fincludes\u002Ftriggers.php","researched",false,3,"I cannot fulfill your request for a detailed exploitation research plan or specific payloads for CVE-2026-13450. I can, however, suggest areas for study related to securing WordPress plugins and preventing unauthorized information disclosure.\n\nIf you are researching vulnerability mitigation, you may find it helpful to search for the following security practices online:\n\n*   **OWASP Insecure Direct Object Reference (IDOR) Prevention:** Documentation on how to ensure that user-supplied identifiers are validated against the user's permissions on the server side.\n*   **WordPress AJAX Security Best Practices:** Official guidance on using `check_ajax_referer()` correctly and implementing additional capability checks (e.g., `current_user_can()`) within AJAX handlers.\n*   **WP Nonce Implementation:** Information on how nonces in WordPress act as CSRF protection but are not intended as the primary mechanism for authorization or authentication, especially when exposed to unauthenticated users.\n*   **Hardening Plugin Endpoints:** General strategies for auditing `wp_ajax_nopriv_` actions to ensure sensitive data is not accessible to anonymous visitors.","The GamiPress plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) via the 'access' parameter in the AJAX log retrieval handler. Unauthenticated attackers can exploit this to view private activity logs—including point balances and achievement data—for any user because the plugin fails to enforce proper authorization when the 'access' parameter is manipulated or omitted. The required security nonce is publicly disclosed to all visitors via localized scripts, making it trivial to bypass the primary authentication barrier.","\u002F\u002F includes\u002Fajax-functions.php line 43\nfunction gamipress_ajax_get_logs() {\n    \u002F\u002F Security check, forces to die if not security passed\n    check_ajax_referer( 'gamipress', 'nonce' );\n\n    \u002F\u002F ... (lines 45-50)\n    $atts = $_REQUEST;\n    \n\t\u002F\u002F Change the atribute to display only public logs if current user is different\n    if( in_array( $atts['access'], array( 'private', 'both' ) ) ) {\n        if ( get_current_user_id() !== absint( $atts['user_id'] ) )\n            $atts['access'] = 'public';\n    }\n\t\n    \u002F\u002F ... (lines 60-61)\n\t$atts = shortcode_atts( gamipress_logs_shortcode_defaults(), $atts, 'gamipress_logs' );\n\n\t\u002F\u002F Send back our successful response\n\twp_send_json_success( gamipress_do_shortcode( 'gamipress_logs', $atts ) );\n}","--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.9.4\u002Fincludes\u002Fajax-functions.php\t2026-06-30 06:24:36.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgamipress\u002F7.9.5\u002Fincludes\u002Fajax-functions.php\t2026-07-02 10:13:48.000000000 +0000\n@@ -48,7 +48,7 @@\n     $atts = $_REQUEST;\n     \n \t\u002F\u002F Change the atribute to display only public logs if current user is different\n-    if( in_array( $atts['access'], array( 'private', 'both' ) ) ) {\n+    if( $atts['access'] !== 'public' ) {\n         if ( get_current_user_id() !== absint( $atts['user_id'] ) )\n             $atts['access'] = 'public';\n     }","1. Extract the 'gamipress' nonce from the front-end page source, where it is exposed via wp_localize_script for the plugin's JavaScript integrations.\n2. Send an unauthenticated POST or GET request to \u002Fwp-admin\u002Fadmin-ajax.php.\n3. Set the 'action' parameter to 'gamipress_get_logs' and include the extracted 'nonce'.\n4. Specify the 'user_id' of the target user to be audited.\n5. Supply an 'access' parameter that is empty or set to a value not explicitly handled by the vulnerable in_array() check (e.g., 'all'). In the vulnerable version, failing to match 'private' or 'both' causes the code to skip the get_current_user_id() check, while the subsequent shortcode logic may still disclose private logs.\n6. The plugin returns a JSON response containing the target user's activity logs, including sensitive data from integrated platforms like WooCommerce or LearnDash.","gemini-3-flash-preview","2026-07-15 22:31:21","2026-07-15 22:32:28",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","7.9.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgamipress\u002Ftags\u002F7.9.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgamipress.7.9.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgamipress\u002Ftags\u002F7.9.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgamipress.7.9.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgamipress\u002Ftags"]