CVE-2025-13812: GamiPress WordPress Information Disclosure

CVE-2025-13812 Overview

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This broken access control vulnerability makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate users, including their email addresses and to retrieve titles of private posts.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can enumerate user data including email addresses and access private post titles, potentially leading to targeted phishing attacks and information disclosure.

Affected Products

• GamiPress WordPress Plugin versions up to and including 7.6.1
• WordPress sites using vulnerable GamiPress plugin versions
• Any WordPress installation with the affected plugin installed and active

Discovery Timeline

• 2026-01-06 - CVE CVE-2025-13812 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-13812

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when software does not perform an authorization check when an actor attempts to access a resource or perform an action. The affected AJAX handler functions gamipress_ajax_get_posts and gamipress_ajax_get_users fail to verify that the requesting user has appropriate capabilities before returning sensitive data.

The vulnerability is network-accessible and requires low attack complexity, meaning attackers only need valid subscriber-level credentials to exploit it. While the confidentiality impact is limited to user enumeration and private post titles, this information can be leveraged for subsequent attacks such as targeted phishing campaigns or social engineering.

Root Cause

The root cause of this vulnerability is a missing capability check (authorization bypass) in the AJAX handler functions. The gamipress_ajax_get_posts and gamipress_ajax_get_users functions process requests from authenticated users without verifying whether those users have the appropriate WordPress capabilities to access user data or private post information. This allows any authenticated user, including those with minimal Subscriber-level permissions, to invoke these functions and retrieve sensitive data that should be restricted to administrators or editors.

Attack Vector

An attacker exploiting this vulnerability would need to:

1. Create or compromise a WordPress account with at least Subscriber-level access on the target site
2. Authenticate to the WordPress installation
3. Send crafted AJAX requests to the vulnerable gamipress_ajax_get_posts or gamipress_ajax_get_users endpoints
4. Parse the returned data to enumerate users and their email addresses or retrieve private post titles

The attack can be performed over the network without user interaction, making it easily automatable for mass data extraction. The vulnerability specifically exposes user enumeration capabilities that could reveal email addresses for all registered users on the WordPress site, as well as titles of posts marked as private.

Detection Methods for CVE-2025-13812

Indicators of Compromise

• Unusual volume of AJAX requests to gamipress_ajax_get_posts or gamipress_ajax_get_users endpoints from subscriber accounts
• Repeated authenticated requests attempting to enumerate user data from low-privilege accounts
• Web server logs showing patterns of automated requests to GamiPress AJAX handlers
• Subscriber-level accounts making administrative-style data queries

Detection Strategies

• Monitor WordPress AJAX request logs for suspicious activity targeting GamiPress endpoints
• Implement Web Application Firewall (WAF) rules to detect bulk user enumeration attempts
• Review access logs for abnormal patterns of authenticated requests from subscriber accounts
• Deploy intrusion detection signatures for WordPress plugin abuse patterns

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and review regularly
• Set up alerts for high-frequency AJAX requests from individual user sessions
• Monitor for new subscriber account registrations followed by immediate data enumeration activity
• Implement rate limiting on AJAX endpoints to slow automated exploitation attempts

How to Mitigate CVE-2025-13812

Immediate Actions Required

• Update GamiPress plugin to the latest patched version immediately
• Audit WordPress user accounts for suspicious subscriber-level accounts
• Review access logs for evidence of prior exploitation attempts
• Consider temporarily disabling the GamiPress plugin until patching is complete

Patch Information

The vulnerability has been addressed by the GamiPress developers. The fix is documented in the WordPress Plugin Changeset 3430697. Site administrators should update to a version newer than 7.6.1 through the WordPress plugin update mechanism. Additional technical details are available in the Wordfence Vulnerability Report.

Workarounds

• Restrict user registration on WordPress sites to prevent attackers from easily obtaining subscriber credentials
• Implement additional access control layers using security plugins that enforce capability checks
• Use a WAF to block suspicious AJAX request patterns targeting the vulnerable endpoints
• Remove or deactivate the GamiPress plugin if gamification features are not critical to site operations

# WordPress CLI command to check GamiPress version
wp plugin list --name=gamipress --fields=name,version,update_version

# Update GamiPress to latest version
wp plugin update gamipress

# Verify update was successful
wp plugin get gamipress --field=version