Unauthenticated Arbitrary Shortcode Execution Vulnerability in GamiPress Plugin

CVE-2024-11036

Summary

The GamiPress plugin, widely utilized for gamification in WordPress websites, is exposed to a security vulnerability that permits arbitrary shortcode execution through the gamipress_get_user_earnings AJAX action. All versions up to and including 7.1.5 do not adequately validate user-supplied input before processing it through the do_shortcode function. This oversight can be exploited by unauthenticated users, enabling them to run unauthorized shortcodes and potentially execute harmful code or commands on the server. Website owners utilizing GamiPress should promptly evaluate their installations to mitigate risks associated with this vulnerability.

References