CVE-2024-13495: GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipressajaxgetlogs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13495?
CVE-2024-13495 has a high severity rating due to its potential for arbitrary shortcode execution.
How do I fix CVE-2024-13495?
To fix CVE-2024-13495, update the GamiPress plugin to version 7.2.2 or later.
Who is affected by CVE-2024-13495?
Anyone using the GamiPress plugin for WordPress versions up to and including 7.2.1 is affected by CVE-2024-13495.
What functionality does CVE-2024-13495 impact?
CVE-2024-13495 impacts the gamipress_ajax_get_logs() function, allowing arbitrary shortcode execution.
Is CVE-2024-13495 present in future versions of GamiPress?
No, CVE-2024-13495 is not present in versions after 7.2.1, specifically starting from version 7.2.2.