CVE-2026-107320: GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GamiPress WordPress pluginto a version that resolves this vulnerability.Fixed in 8.0.6
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can retrieve private activity log entries. No account or authenticated WordPress session is required.
Which installations are affected?
GamiPress versions before 8.0.6 are affected. The reported affected range is 7.9.5 through 8.0.5.
What information may be exposed?
Private activity logs for all users may be disclosed. The available data does not specify the exact fields or content contained in those log entries.
What should be done if the site cannot be updated immediately?
The provided information identifies the authorization flaw but does not document a workaround. Restricting unauthenticated access to the affected functionality may reduce exposure until GamiPress can be updated to 8.0.6 or later.