CVE-2024-13495: GamiPress WordPress Plugin RCE Vulnerability

CVE-2024-13495 Overview

CVE-2024-13495 affects the GamiPress WordPress plugin, a gamification tool used to award points, achievements, badges, and ranks. All versions up to and including 7.2.1 contain an arbitrary shortcode execution flaw in the gamipress_ajax_get_logs() function. The function passes user-controlled input to WordPress do_shortcode without proper validation. Unauthenticated attackers can trigger the AJAX endpoint and execute arbitrary shortcodes against the site. Depending on installed plugins and theme shortcodes, this can lead to information disclosure, content manipulation, or further abuse of shortcode-exposed functionality. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can invoke arbitrary WordPress shortcodes through the GamiPress AJAX handler, potentially exposing sensitive data or abusing privileged shortcodes registered by other plugins.

Affected Products

GamiPress plugin for WordPress, all versions through 7.2.1
WordPress sites with GamiPress installed and active
Sites combining GamiPress with plugins that expose sensitive shortcodes

Discovery Timeline

2025-01-22 - CVE-2024-13495 published to the National Vulnerability Database
2025-01-24 - Last updated in NVD database

Technical Details for CVE-2024-13495

Vulnerability Analysis

The vulnerability resides in the gamipress_ajax_get_logs() function defined in includes/ajax-functions.php of the GamiPress plugin. The handler is registered as a WordPress AJAX endpoint accessible to unauthenticated users through wp-admin/admin-ajax.php. Attacker-supplied parameter values are passed to do_shortcode() without validating that the input represents a safe, expected value. Because do_shortcode() parses and executes any registered shortcode in the supplied string, an attacker can craft a request that invokes shortcodes provided by GamiPress, WordPress core, the active theme, or other installed plugins. See the WordPress GamiPress AJAX Function source and the Wordfence Vulnerability Report for analysis.

Root Cause

The root cause is missing input validation before invoking a code-evaluation primitive. The plugin treats the AJAX parameter as a trusted value rather than confining it to an allowlist of expected log identifiers. WordPress do_shortcode() is intended to render trusted, author-supplied content. Exposing it to unauthenticated request data converts a templating helper into an arbitrary code-evaluation surface, matching the pattern described in CWE-94.

Attack Vector

The attack is fully remote and requires no authentication or user interaction. An attacker sends a crafted POST request to wp-admin/admin-ajax.php invoking the vulnerable action and supplies a shortcode payload in the parameter consumed by gamipress_ajax_get_logs(). The server expands the shortcode, returns its output in the AJAX response, and may execute any side effects implemented by the targeted shortcode. Sensitive shortcodes from other plugins, including those that return user data, configuration values, or perform privileged operations, become reachable from the internet. Refer to the GamiPress changeset 3226227 for the upstream fix.

Detection Methods for CVE-2024-13495

Indicators of Compromise

Unauthenticated POST requests to /wp-admin/admin-ajax.php referencing GamiPress log actions with shortcode syntax such as [ and ] in parameter values
Web server logs showing high-volume AJAX requests to GamiPress actions from a small set of source IPs
Anomalous shortcode output appearing in AJAX responses, including content from unrelated plugins
New or unexpected outbound connections initiated by php-fpm or the web server worker following requests to GamiPress endpoints

Detection Strategies

Inspect admin-ajax.php request bodies for shortcode delimiters in parameters bound to GamiPress actions and alert on unauthenticated callers
Compare the installed GamiPress version against 7.2.1 across all managed WordPress sites and flag vulnerable instances
Correlate AJAX request spikes with subsequent database read activity or sensitive shortcode rendering

Monitoring Recommendations

Forward WordPress access logs and PHP error logs to a centralized analytics platform for query-based hunting
Enable Web Application Firewall (WAF) logging for admin-ajax.php with rules that flag shortcode payloads from unauthenticated sessions
Track plugin inventory drift to detect sites still running GamiPress versions at or below 7.2.1

How to Mitigate CVE-2024-13495

Immediate Actions Required

Update GamiPress to the version released in changeset 3226227, which is later than 7.2.1
Audit installed plugins and themes for shortcodes that expose sensitive data or privileged actions and restrict them
Review web server and AJAX logs for prior exploitation attempts containing shortcode syntax in GamiPress parameters
Rotate credentials or tokens that could have been exposed through shortcodes returning configuration data

Patch Information

The GamiPress maintainers addressed the issue in the plugin update referenced by WordPress.org plugin changeset 3226227. The fix validates the value handled by gamipress_ajax_get_logs() before it is passed to do_shortcode(). Site operators should upgrade through the WordPress plugin updater or by deploying the patched release from the GamiPress plugin page.

Workarounds

Disable the GamiPress plugin until the patched version can be installed if immediate upgrade is not possible
Block unauthenticated requests to wp-admin/admin-ajax.php GamiPress actions at the WAF or reverse proxy layer
Add a WAF rule to reject requests where GamiPress AJAX parameters contain shortcode delimiters such as [ and ]

bash

# Example nginx rule to block shortcode payloads on GamiPress AJAX actions
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "gamipress_get_logs") {
        if ($request_body ~* "\[[a-z0-9_\-]+") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}