CVE-2026-107319: CWE-639 Authorization Bypass Through User-Controlled Key in GamiPress
Description
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.
CVSS v3.1
Score 4.3medium
Affected software
GamiPress
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-107319 is an authorization bypass vulnerability in the GamiPress WordPress plugin prior to version 8.0.6. The plugin fails to perform capability checks or ownership verification on one of its authenticated AJAX actions. As a result, any authenticated user can access arbitrary activity log entries, exposing sensitive user data such as points balances, achievements, and administrator usernames involved in manual point adjustments.
Potential Impact
The vulnerability allows authenticated users with minimal privileges to access sensitive information from the activity log that should be restricted. This includes other users' points balances and achievements, potentially leading to privacy violations and unauthorized disclosure of administrative actions. There is no indication of code execution or privilege escalation beyond information disclosure.
Mitigation Recommendations
Upgrade GamiPress to version 8.0.6 or later, where this authorization bypass vulnerability has been fixed. If upgrading is not immediately possible, restrict authenticated user roles to trusted users only until the patch can be applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-07T17:33:38.561Z
- State
- PUBLISHED
Threat ID: 6acf22562cdf04f656513b92
Added to database: 10/14/2026, 06:33:58 UTC
Last enriched: 10/14/2026, 07:05:05 UTC
Last updated: 10/14/2026, 19:00:33 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.