CVE-2024-30455 Overview
CVE-2024-30455 is a Cross-Site Request Forgery (CSRF) vulnerability in the GamiPress plugin for WordPress. The flaw affects all versions of GamiPress up to and including 6.8.5. An attacker can craft a malicious web page that triggers state-changing requests in the plugin when an authenticated user visits the page. Successful exploitation requires user interaction, such as clicking a link or loading attacker-controlled content. The issue is classified under CWE-352: Cross-Site Request Forgery.
Critical Impact
Attackers can trick authenticated GamiPress users into performing unintended actions in the plugin, resulting in limited integrity impact on the WordPress site.
Affected Products
- GamiPress WordPress plugin versions up to and including 6.8.5
- WordPress sites running vulnerable GamiPress installations
- Any environment where authenticated administrators or privileged users interact with GamiPress
Discovery Timeline
- 2024-03-29 - CVE-2024-30455 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-30455
Vulnerability Analysis
GamiPress is a WordPress gamification plugin that adds points, achievements, and ranks to sites. The plugin exposes state-changing endpoints that do not adequately verify the origin of incoming requests. An attacker hosting a malicious page can cause an authenticated victim's browser to submit forged requests to the target WordPress instance. Because the browser automatically includes session cookies, the vulnerable endpoint processes the request as if the victim initiated it. The confidentiality impact is none, integrity impact is low, and availability impact is none. Exploitation requires the victim to be authenticated and to interact with attacker-controlled content.
Root Cause
The root cause is missing or insufficient anti-CSRF protection on state-changing actions within GamiPress. WordPress provides nonce primitives such as wp_nonce_field() and check_admin_referer() to bind requests to a valid user session. When these primitives are absent or improperly validated, forged cross-origin requests are accepted as legitimate. Full technical analysis is available in the Patchstack CSRF Vulnerability Report.
Attack Vector
An attacker crafts an HTML page containing a hidden form or image tag that targets a vulnerable GamiPress endpoint. The attacker delivers the page through phishing, a compromised website, or a malicious advertisement. When an authenticated GamiPress administrator visits the page, the browser submits the request with valid session cookies. The plugin processes the request and applies the attacker-specified changes without validating the request origin.
Detection Methods for CVE-2024-30455
Indicators of Compromise
- Unexpected changes to GamiPress configuration, points, achievements, or user rank data
- Administrative POST requests to GamiPress endpoints lacking a valid WordPress nonce parameter
- HTTP requests to GamiPress admin endpoints containing external Referer headers
- Log entries showing state-changing GamiPress actions performed outside normal administrative sessions
Detection Strategies
- Review web server access logs for GamiPress admin URLs originating from off-site referrers
- Audit GamiPress activity logs for configuration changes that lack a corresponding admin session
- Correlate WordPress user session activity with GamiPress state changes to identify anomalies
Monitoring Recommendations
- Enable WordPress audit logging to capture all administrative actions performed by privileged users
- Monitor for phishing campaigns targeting WordPress administrators of sites running GamiPress
- Track plugin version inventories across WordPress deployments to identify vulnerable instances
How to Mitigate CVE-2024-30455
Immediate Actions Required
- Update GamiPress to a version later than 6.8.5 as soon as a patched release is available
- Restrict WordPress administrator accounts and enforce least privilege for GamiPress management
- Instruct administrators to log out of WordPress sessions when not actively managing the site
- Deploy a Web Application Firewall (WAF) rule to block cross-origin POST requests to GamiPress endpoints
Patch Information
Refer to the Patchstack CSRF Vulnerability Report for the latest patch status and vendor guidance. Site operators should upgrade to the fixed GamiPress release once published by the vendor and validate that anti-CSRF nonces are enforced on all state-changing endpoints.
Workarounds
- Disable the GamiPress plugin until a patched version is installed if the risk is unacceptable
- Require administrators to use isolated browser profiles or sessions when managing WordPress
- Configure the WordPress site with strict SameSite=Lax or SameSite=Strict cookie attributes to reduce CSRF exposure
- Add server-side referrer validation for GamiPress admin routes through a WAF or reverse proxy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
