CVE-2024-13499: GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function
The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipressdoshortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13499?
CVE-2024-13499 has been classified as a high severity vulnerability due to the potential for arbitrary shortcode execution.
How do I fix CVE-2024-13499?
To fix CVE-2024-13499, update the GamiPress plugin to version 7.2.2 or later.
What does CVE-2024-13499 exploit?
CVE-2024-13499 exploits a vulnerability in the gamipress_do_shortcode() function that allows arbitrary shortcode execution.
Which versions of GamiPress are affected by CVE-2024-13499?
All versions of GamiPress up to and including 7.2.1 are affected by CVE-2024-13499.
What type of attack is possible with CVE-2024-13499?
CVE-2024-13499 allows attackers to execute arbitrary shortcodes on affected WordPress sites.