Vulnerabilities / GamiPress
GamiPress vulnerabilities
Advisories WPSec published for GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI. Other sources may list more. Its attack surface: GamiPress on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-14 | WPSEC-2026-0917 | GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Rank Modification via gamipress_profile_update_user_rank AJAX Action | Medium 4.3 | 8.0.6 |
| 2026-10-14 | WPSEC-2026-0916 | GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Sensitive Information Exposure via Log Extra Data AJAX Action | Medium 4.3 | 8.0.6 |
| 2026-10-14 | WPSEC-2026-0915 | GamiPress <= 8.0.5 - Unauthenticated Sensitive Information Exposure via 'user_id' Parameter of gamipress_get_logs AJAX Action | Medium 5.3 | 8.0.6 |
| 2026-10-14 | WPSEC-2026-0914 | GamiPress <= 8.0.5 - Authenticated (Subscriber+) Missing Authorization to Points and Rank Modification via REST API User Meta | Medium 4.3 | 8.0.6 |
License: CC BY 4.0