CVE-2026-13450

Name of the Vulnerable Software and Affected Versions GamiPress – Gamification plugin for WordPress versions prior to 7.9.5

Description An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user-controlled key. This allows unauthenticated attackers to view private activity log entries of any user, including points balance changes, badge earnings, and event records from integrated plugins like WooCommerce, LearnDash, and BuddyPress. The issue is exploitable via the access parameter. The authentication mechanism is bypassed because the gamipress nonce is broadcast to all front-end users through the wp localize script function on the wp enqueue scripts hook.

Recommendations Update the plugin to version 7.9.5 or later. As a temporary mitigation, restrict access to the access parameter until the update is applied.