CVE-2024-11036: GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings
The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipressgetuserearnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11036?
CVE-2024-11036 has a medium severity rating as it allows for arbitrary shortcode execution.
How do I fix CVE-2024-11036?
To fix CVE-2024-11036, update the GamiPress plugin to version 7.1.6 or later.
What versions are affected by CVE-2024-11036?
CVE-2024-11036 affects all versions of GamiPress up to and including 7.1.5.
Is there a specific action that exploits CVE-2024-11036?
Yes, the vulnerability is exploited via the gamipress_get_user_earnings AJAX action.
What can happen if I don't address CVE-2024-11036?
If left unaddressed, CVE-2024-11036 can allow attackers to execute arbitrary code on your WordPress site.