CVE-2026-13450: GamiPress IDOR Vulnerability Exposes Private User Activity Logs

Technical summary

CVE-2026-13450 is an Insecure Direct Object Reference (IDOR) vulnerability affecting GamiPress versions up to 7.9.4. The flaw resides in the 'access' parameter, which lacks proper authorization checks. An unauthenticated attacker can bypass the intended access controls by leveraging the 'gamipress' nonce, which is exposed to all front-end users via wp_localize_script during wp_enqueue_scripts. This allows direct enumeration and retrieval of private activity log data for any user. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key).

Business impact

This exposure creates privacy and compliance risks. Activity logs can reveal user behavior patterns, purchase history (via WooCommerce integration), course progress (via LearnDash), and social interactions (via BuddyPress). For platforms subject to GDPR, CCPA, or similar regulations, unauthorized disclosure of user activity may trigger breach notification obligations. Competitor sites could extract user engagement data; malicious actors could harvest behavioral intelligence to target users off-platform. Organizations relying on GamiPress to drive engagement and retention may face reputational damage if user privacy breaches become public.

Affected systems

GamiPress – Gamification plugin for WordPress in all versions up to and including 7.9.4 is vulnerable. Any WordPress installation running the plugin with that version or earlier is at risk. The vulnerability affects all deployment contexts: multisite and single-site installations, regardless of privacy settings or access controls configured in WordPress itself, because the flaw bypasses WordPress authentication entirely.

Exploitability

Exploitability is trivial. The vulnerability requires no authentication, no user interaction, and no special configuration. An attacker needs only network access to the WordPress site and knowledge of the user ID to enumerate. The nonce—intended as a CSRF protection token—is publicly accessible in the page source and JavaScript, eliminating it as a meaningful barrier. The attack surface is every unauthenticated visitor, including crawlers and automated tools. Proof-of-concept exploitation is straightforward API or HTTP request manipulation.

Remediation

Update GamiPress to a patched version beyond 7.9.4 immediately. The patch should implement proper capability checks and nonce verification tied to user roles, ensuring only authorized users can view activity logs. Verify the update against the vendor's official advisory to confirm the specific patched version number. For sites unable to update immediately, consider disabling the GamiPress activity log feature or restricting front-end access to the affected endpoints via web application firewall rules or .htaccess if applicable.

Patch guidance

1. Back up your WordPress database and plugins directory. 2. Navigate to Plugins > Installed Plugins and check GamiPress version. 3. If at or below 7.9.4, go to Plugins > Available Plugins, search GamiPress, and click 'Update Now'. 4. If automatic updates fail, manually download the latest version from the plugin repository and upload via SFTP/file manager. 5. Verify the new version in the plugin details page. 6. Test activity log functionality as an authenticated admin and as an unauthenticated user to confirm access is now properly restricted. 7. Review your WordPress security audit logs for any suspicious access patterns from the publication date onward.

Detection guidance

Monitor web server and WordPress logs for HTTP requests to endpoints that handle activity log retrieval (typically involving the 'access' parameter or GamiPress activity log API calls). Look for requests originating from non-authenticated sessions with suspicious user ID parameters (sequential or enumeration patterns). Enable WordPress debug logging and check for authorization bypass attempts. Use WordPress security plugins (e.g., Wordfence, Sucuri) to alert on unexplained data access patterns. Correlate access log timestamps with plugin publication date (2026-07-09) to identify potential exploitation before patching. Consider running a log analysis query to identify any user IDs that were queried before their legitimate first login.

Why prioritize this

Although the CVSS score is 5.3 (MEDIUM), the practical risk is elevated due to trivial exploitability and high-value target data (user behavior, spending, learning activity). The attack requires zero authentication and zero user interaction, making it a prime target for automated scanning. WordPress plugin vulnerabilities are heavily researched by threat actors. Privacy-sensitive data exposure warrants faster patching than the CVSS baseline suggests, particularly for organizations managing sensitive user bases.

Risk score, explained

CVSS 3.1 score of 5.3 reflects a network-adjacent, low-complexity attack with no privilege requirement and no user interaction—yielding a MEDIUM severity rating. The score correctly captures the confidentiality impact (low), no integrity or availability impact. However, the practical risk may be understated: the trivial exploitability (public nonce, no authentication), high-value target data (user activity logs with cross-plugin integration), and low barrier to deployment make this a higher operational priority than the numeric score suggests. Organizations should weight deploying this patch with the sensitivity of data managed by their WordPress environment.

Frequently asked questions