CVE-2024-13499: GamiPress WordPress Plugin RCE Vulnerability

CVE-2024-13499 Overview

CVE-2024-13499 affects the GamiPress WordPress plugin in all versions up to and including 7.2.1. The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes through the gamipress_do_shortcode() function. The plugin fails to properly validate user-supplied values before passing them to WordPress's do_shortcode function.

The flaw is classified as Improper Control of Generation of Code [CWE-94]. Attackers can invoke any registered shortcode on the target site without authentication, enabling data exposure, content manipulation, or abuse of privileged shortcode functionality installed by other plugins.

Critical Impact
Unauthenticated attackers can trigger arbitrary WordPress shortcodes on affected sites, potentially exposing site data or invoking privileged plugin functionality.

Affected Products

GamiPress plugin for WordPress, all versions up to and including 7.2.1
WordPress sites using GamiPress with default configuration
Sites combining GamiPress with other shortcode-providing plugins expand the attack surface

Discovery Timeline

2025-01-22 - CVE-2024-13499 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13499

Vulnerability Analysis

GamiPress exposes the gamipress_do_shortcode() helper defined in includes/functions.php. This function accepts a value supplied through a plugin-handled action and passes it directly into WordPress's core do_shortcode() call. Because the plugin does not restrict which shortcode tags are permitted or verify the requester's identity, any registered shortcode on the site becomes reachable from an unauthenticated HTTP request.

Shortcodes in WordPress can perform database queries, render private content, generate forms, or execute plugin-defined logic. When an attacker controls the shortcode string, they can select any registered tag along with its attributes. The impact depends on which shortcodes the target site has installed through GamiPress and other plugins.

Exploitation requires no user interaction and no privileges. The attacker sends a crafted request to the vulnerable action endpoint with a shortcode payload as the input value. The plugin evaluates the shortcode server-side and returns the rendered output.

Root Cause

The root cause is missing input validation in gamipress_do_shortcode() at line 645 of includes/functions.php. The function should enforce an allowlist of permitted shortcode tags or restrict callers to authenticated users with defined capabilities. Instead, it forwards attacker-controlled input to do_shortcode without checks.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP request to the WordPress site invoking the GamiPress action that reaches gamipress_do_shortcode(). The request includes a shortcode string such as one that discloses user data, generates content, or executes plugin-specific behavior. The server evaluates the shortcode and returns the result to the attacker.

The vulnerability mechanism is described in the Wordfence Vulnerability Analysis and the corrected code is visible in the WordPress GamiPress Changeset Update.

Detection Methods for CVE-2024-13499

Indicators of Compromise

HTTP requests to GamiPress AJAX endpoints containing shortcode syntax such as [ and ] characters in POST parameters
Unauthenticated admin-ajax.php calls referencing GamiPress actions with unusual payload values
Web server access logs showing repeated requests with encoded shortcode tags from a single source IP
Unexpected rendering of privileged plugin content in HTTP responses to anonymous clients

Detection Strategies

Inspect WordPress request logs for GamiPress action parameters carrying shortcode markup from unauthenticated sessions
Deploy web application firewall rules that flag shortcode tokens inside POST bodies destined for plugin endpoints
Correlate spikes in admin-ajax.php traffic with the presence of the GamiPress plugin and versions at or below 7.2.1

Monitoring Recommendations

Enable verbose logging on WordPress AJAX and REST endpoints to capture full request bodies for post-incident review
Track the installed GamiPress version across managed WordPress sites and alert when versions are at or below 7.2.1
Monitor outbound responses from GamiPress actions for content that matches registered shortcode output patterns

How to Mitigate CVE-2024-13499

Immediate Actions Required

Update GamiPress to a version above 7.2.1 that includes the fix from changeset 3226227
Audit the WordPress site for all registered shortcodes and assess which could leak data or perform sensitive operations if invoked by an anonymous user
Restrict access to admin-ajax.php and REST endpoints via a web application firewall until the plugin is patched

Patch Information

The vendor addressed the issue in the commit tracked at WordPress GamiPress Changeset Update. The fixed code in includes/functions.php adds validation before do_shortcode() is invoked. Review the current implementation at the WordPress GamiPress Functions File and the specific line at the WordPress GamiPress Functions Reference.

Workarounds

Deactivate the GamiPress plugin until the site can be updated to a patched release
Add a WAF rule that blocks shortcode syntax in POST parameters sent to GamiPress AJAX actions
Remove or disable unused shortcode-providing plugins to reduce the set of shortcodes an attacker could invoke

bash

# Update GamiPress via WP-CLI once a patched release is available
wp plugin update gamipress
wp plugin get gamipress --field=version