# GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Points and Rank Modification via REST API User Meta

- **ID:** WPSEC-2026-0914
- **Plugin:** GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI (`gamipress`), https://wordpress.org/plugins/gamipress/
- **Affected versions:** from 1.8.0 before 8.0.6
- **Fixed in:** 8.0.6 (Update to 8.0.6 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gamipress
- **Fix released:** 2026-10-08
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0914/

## Description

The GamiPress plugin for WordPress is vulnerable to unauthorized modification of data via the REST API user meta fields in versions 1.8.0 up to, and including, 8.0.5, due to the points balance and current rank metas being registered with 'show_in_rest' enabled and an 'auth_callback' of __return_true. This makes it possible for authenticated attackers, with subscriber-level access and above, to set their own GamiPress points balances and current ranks through the WordPress REST API users endpoint.

## References

- https://wpsec.com/vuln/WPSEC-2026-0914/
- https://plugins.svn.wordpress.org/gamipress/tags/8.0.6/
- https://wordpress.org/plugins/gamipress/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0914/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.