CVE-2026-13450 is an authorization bypass vulnerability (CWE-639) in the GamiPress – Gamification plugin for WordPress, affecting all versions up to and including 7.9.4. The vulnerability arises from insecure direct object references via the 'access' parameter due to missing validation of a user-controlled key. Because the 'gamipress' nonce used for authentication is exposed to all front-end users through wp_localize_script on the wp_enqueue_scripts hook, unauthenticated attackers can bypass authentication and access private activity log entries belonging to any user. These logs include sensitive information such as badge earnings, points balance changes, and event records from integrated plugins like WooCommerce, LearnDash, and BuddyPress.

An unauthenticated attacker can view private user activity logs in GamiPress, potentially exposing sensitive user information related to gamification achievements and integrated plugin events. The confidentiality of user data is compromised, but there is no impact on integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin features or disable the plugin if possible to prevent unauthorized access. Monitor vendor channels for updates and apply patches promptly once released.