CVE-2026-107319

Deferred Deferred - Pending Action

Information Disclosure in GamiPress WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107319

EUVD

EUVD-2026-100890

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	GamiPress	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in the GamiPress WordPress plugin before version 8.0.6 allows any authenticated user, including low-privilege users like Subscribers, to read arbitrary entries from the plugin's activity log without proper permission checks. This exposes sensitive data such as other users' points balances, earned achievements, and administrator usernames involved in manual point adjustments.

Detection Guidance

To detect this vulnerability, check the installed version of the GamiPress plugin. If it is below 8.0.6, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin files for version details.

Impact Analysis

An attacker with access to the site could exploit this to view other users' points balances, achievements, and administrator actions. This could lead to privacy violations, data leaks, or enable further attacks by gathering sensitive information about user activity and system operations.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without consent and HIPAA by leaking sensitive user information. It undermines data protection requirements for confidentiality and access controls, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies

Immediately update the GamiPress plugin to version 8.0.6 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Hi! I’m here to help you understand CVE-2026-107319. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70