CVE-2026-13450 describes an insecure direct object reference vulnerability (CWE-639) in the GamiPress plugin for WordPress versions up to and including 7.9.4. The vulnerability arises from missing validation on a user-controlled 'access' parameter, which allows unauthenticated attackers to access private GamiPress activity log entries of any user. The authentication mechanism relies on a 'gamipress' nonce that is broadcast to all front-end users via wp_localize_script on the wp_enqueue_scripts hook, effectively allowing any visitor to bypass authentication and view sensitive user data such as badge earnings, points balance changes, and event records from integrated plugins like WooCommerce, LearnDash, and BuddyPress. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact.

An unauthenticated attacker can view private activity log entries of any user in the GamiPress plugin, including sensitive information such as badge earnings, points balance changes, and event records from integrated plugins. This exposure compromises user privacy but does not allow modification or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented as of the provided data. Until a patch is available, consider restricting access to the affected plugin's activity logs or disabling the plugin if possible to prevent unauthorized data disclosure.