{
 "id": "WPSEC-2026-1285",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1285/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1285/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1285/index.md",
 "title": "GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI <= 8.0.7 - Authenticated (Subscriber+) Missing Authorization to Private Post Title Disclosure via Rank and Achievement Options AJAX Actions",
 "description": "The GamiPress plugin for WordPress is vulnerable to unauthorized access of data via the gamipress_get_ranks_options, gamipress_get_ranks_options_html and gamipress_get_achievements_options AJAX actions in all versions up to, and including, 8.0.7, due to missing capability checks (and, for two of the handlers, missing nonce verification). The rank option handlers accept any post type from the request and return the IDs and titles of matching posts with 'publish', 'private' or 'inherit' status. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve the IDs and titles of private posts, pages and other post types, as well as achievement and rank data meant only for GamiPress managers.",
 "plugin": {
  "slug": "gamipress",
  "name": "GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI",
  "full_name": "GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI",
  "wordpress_org": "https://wordpress.org/plugins/gamipress/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gamipress/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gamipress"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.0.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.0.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.0.8",
 "remediation": "Update to 8.0.8 or later.",
 "fix_released": "2026-10-19T20:43:41+00:00",
 "published": "2026-10-21T10:43:36+00:00",
 "updated": "2026-10-21T10:34:18.687465+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1285/",
  "https://plugins.svn.wordpress.org/gamipress/tags/8.0.8/",
  "https://wordpress.org/plugins/gamipress/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gamipress",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-21"
 }
}