Unverified AJAX Actions in GamiPress Plugin by WordPress Expose User Activity
CVE-2026-107319
Key Information:
Badges
What is CVE-2026-107319?
The GamiPress plugin for WordPress, prior to version 8.0.6, features a significant vulnerability due to its lack of capability checks and ownership verification on certain authenticated AJAX actions. This oversight enables any authenticated user, such as a Subscriber, to access sensitive information in the activity log. Specifically, users can view other users' points balances, achievements, and the usernames of administrators who carry out point award or revoke actions. Such exposure can lead to privacy concerns and unauthorized insight into user interactions within the application.
Affected Version(s)
GamiPress 0 < 8.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.