CVE-2026-107319 Overview
CVE-2026-107319 affects the GamiPress WordPress plugin in versions prior to 8.0.6. The plugin exposes an authenticated AJAX action that lacks both a capability check and ownership verification. Any authenticated user, including a low-privileged Subscriber, can read arbitrary entries from the plugin's activity log. Disclosed data includes other users' points balances, earned achievements, and the usernames of administrators who performed manual point award and revoke actions. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated users with Subscriber-level access can enumerate activity log entries belonging to other users and administrators, exposing gamification data and administrator usernames.
Affected Products
- GamiPress WordPress plugin versions before 8.0.6
- WordPress sites with authenticated user registration enabled
- Deployments relying on GamiPress activity log confidentiality
Discovery Timeline
- 2026-10-14 - CVE-2026-107319 published to NVD
- 2026-10-14 - Last updated in NVD database
Technical Details for CVE-2026-107319
Vulnerability Analysis
The GamiPress plugin provides points, achievements, and ranks functionality for WordPress sites. One of its AJAX endpoints returns activity log entries without validating the caller's authorization to view the requested records. The handler accepts a user-controlled identifier and returns the corresponding log data regardless of whether the requester owns the record or holds a privileged role.
The vulnerability is an Insecure Direct Object Reference (IDOR). The server trusts the client-supplied key and omits the ownership comparison that would normally restrict log reads to the owning user or an administrator. The impact is limited to confidentiality of gamification data, but the exposed data includes administrator usernames tied to point award and revoke actions, which is useful for targeted follow-on attacks.
Root Cause
The root cause is a missing authorization check inside an authenticated AJAX action. The handler neither calls current_user_can() with an appropriate capability nor compares the record's owning user ID against the current session. This matches the CWE-639 pattern where access decisions are made on a user-controlled key.
Attack Vector
Exploitation requires only a valid WordPress account at the Subscriber level. The attacker submits a crafted AJAX request to the vulnerable action and iterates through log entry identifiers to enumerate records. No user interaction is required beyond the attacker's authenticated session. See the WPScan Vulnerability Advisory for the full technical write-up.
// No verified exploit code is published. The vulnerability is triggered by
// sending authenticated POST requests to the vulnerable admin-ajax.php action
// with sequential log identifiers to enumerate other users' activity records.
Detection Methods for CVE-2026-107319
Indicators of Compromise
- Repeated authenticated POST requests to /wp-admin/admin-ajax.php from Subscriber accounts referencing GamiPress AJAX actions.
- Sequential or enumerated numeric identifiers in AJAX request parameters targeting activity log entries.
- Unusual response sizes returned to low-privileged accounts from GamiPress endpoints.
Detection Strategies
- Review web server access logs for high-frequency admin-ajax.php calls originating from non-administrative sessions.
- Correlate authenticated sessions holding only the Subscriber role with calls to GamiPress-specific AJAX actions.
- Alert on identifier enumeration patterns, such as monotonically incrementing numeric parameters within short time windows.
Monitoring Recommendations
- Enable WordPress audit logging to capture AJAX action names, parameters, and the acting user role.
- Forward web server and WordPress logs to a centralized analytics platform for cross-session correlation.
- Monitor the GamiPress plugin version across managed sites and flag any instance below 8.0.6.
How to Mitigate CVE-2026-107319
Immediate Actions Required
- Update GamiPress to version 8.0.6 or later on all WordPress installations.
- Audit existing user accounts and remove unused Subscriber-level accounts that could be abused for authenticated access.
- Review recent AJAX request logs for signs of activity log enumeration prior to patching.
Patch Information
The vendor fixed this issue in GamiPress 8.0.6 by adding the missing capability and ownership checks to the affected AJAX action. Refer to the WPScan Vulnerability Advisory for advisory details and the fixed version.
Workarounds
- Disable new user registration if the site does not require Subscriber accounts, reducing the attacker pool.
- Restrict access to /wp-admin/admin-ajax.php using a web application firewall rule that blocks the vulnerable GamiPress action for non-privileged roles.
- Temporarily deactivate the GamiPress plugin on sites where upgrading is not immediately feasible.
# Update GamiPress using WP-CLI
wp plugin update gamipress --version=8.0.6
# Verify the installed version
wp plugin get gamipress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
