GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 - Authenticated (Subscriber+) Missing Authorization to Private Post Title Disclosure via Rank and Achievement Options AJAX Actions
- ID
- WPSEC-2026-1285
- Plugin
- GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI (gamipress)
- Affected
- all versions before 8.0.8
- Remediation
- Update to 8.0.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI on WPSec AttackSurface
- Fix released
- Published
Description
The GamiPress plugin for WordPress is vulnerable to unauthorized access of data via the gamipress_get_ranks_options, gamipress_get_ranks_options_html and gamipress_get_achievements_options AJAX actions in all versions up to, and including, 8.0.7, due to missing capability checks (and, for two of the handlers, missing nonce verification). The rank option handlers accept any post type from the request and return the IDs and titles of matching posts with 'publish', 'private' or 'inherit' status. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve the IDs and titles of private posts, pages and other post types, as well as achievement and rank data meant only for GamiPress managers.
References
- https://wpsec.com/vuln/WPSEC-2026-1285/
- https://plugins.svn.wordpress.org/gamipress/tags/8.0.8/
- https://wordpress.org/plugins/gamipress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS