CVE-2024-13495 is a code injection vulnerability in the GamiPress – Gamification plugin for WordPress. The flaw exists in the gamipress_ajax_get_logs() function, which allows unauthenticated users to trigger arbitrary shortcode execution due to insufficient validation before invoking do_shortcode. This improper control of code generation (CWE-94) can lead to unauthorized code execution within the WordPress environment. The vulnerability affects all versions up to and including 7.2.1. No official patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary shortcodes, potentially leading to unauthorized actions that affect confidentiality, integrity, and availability of the affected WordPress site. The CVSS score of 7.3 reflects a high severity level with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the vulnerable gamipress_ajax_get_logs() function or the plugin itself to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.