CVE-2026-107319: GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user can exploit it, including users with the Subscriber role. The affected AJAX action lacks both a capability check and verification that the requester owns the activity-log entry.
What information could an attacker access?
An attacker can read arbitrary GamiPress activity-log entries. Exposed information includes other users' points balances, earned achievements, and usernames of administrators who manually awarded or revoked points.
Which deployments are affected?
GamiPress versions before 8.0.6 are affected. Sites that allow users to authenticate, including sites with Subscriber accounts, have users who could potentially access the vulnerable action.