Vulnerabilities / GamiPress / WPSEC-2026-0914
GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Points and Rank Modification via REST API User Meta
Medium 4.3
CWE-862Fixed in 8.0.6
- ID
- WPSEC-2026-0914
- Plugin
- GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI (gamipress)
- Affected
- from 1.8.0 before 8.0.6
- Remediation
- Update to 8.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- GamiPress on WPSec AttackSurface
- Fix released
- Published
Description
The GamiPress plugin for WordPress is vulnerable to unauthorized modification of data via the REST API user meta fields in versions 1.8.0 up to, and including, 8.0.5, due to the points balance and current rank metas being registered with 'show_in_rest' enabled and an 'auth_callback' of __return_true. This makes it possible for authenticated attackers, with subscriber-level access and above, to set their own GamiPress points balances and current ranks through the WordPress REST API users endpoint.
References
- https://wpsec.com/vuln/WPSEC-2026-0914/
- https://plugins.svn.wordpress.org/gamipress/tags/8.0.6/
- https://wordpress.org/plugins/gamipress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS