Junglewise Threat Intelligence

CVE-2026-13450: GamiPress WordPress plugin IDOR in activity logs

CVE-2026-13450 · Severity: medium · CVSS 5.3 · Published 2026-07-09

Executive brief

GamiPress is a popular WordPress plugin used to add gamification features like points, badges, and rewards to websites. A security flaw allows unauthorized visitors to view private activity logs belonging to any user on the site. This could expose sensitive information such as point balances, earned achievements, and activity records from connected services like WooCommerce or LearnDash.

Technical details

The GamiPress plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to and including 7.9.4. This occurs due to missing validation on the user-controlled 'access' parameter within AJAX functions. While the plugin attempts to use a 'gamipress' nonce for security, this nonce is broadcast to all front-end users via wp_localize_script, allowing unauthenticated attackers to bypass the check. An attacker can exploit this to retrieve private activity log entries, including data from integrated plugins like WooCommerce, LearnDash, and BuddyPress.

Affected products

  • rubengc GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.9.4

Timeline

  • 2026-07-09: disclosed
  • 2026-07-09: advisory

References

Related threats