CVE-2026-107320: GamiPress WordPress Information Disclosure

CVE-2026-107320 Overview

CVE-2026-107320 is an information disclosure vulnerability in the GamiPress WordPress plugin versions prior to 8.0.6. The plugin fails to properly authorize access to private activity log entries. Unauthenticated attackers can retrieve the private activity logs of all users on an affected site. The flaw is an incomplete fix of the earlier CVE-2026-13450, meaning the original patch did not fully close the access control gap. The weakness is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated remote attackers can enumerate and read private user activity logs from any site running a vulnerable version of GamiPress, exposing user behavior and gamification history.

Affected Products

GamiPress WordPress plugin versions prior to 8.0.6
WordPress sites with GamiPress activity logging enabled
Sites previously patched against CVE-2026-13450 that remain on versions below 8.0.6

Discovery Timeline

2026-10-14 - CVE-2026-107320 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107320

Vulnerability Analysis

GamiPress records user activity, including points earned, achievements unlocked, and ranks awarded, in an activity log. Entries can be marked as private so they remain visible only to authorized users. The plugin exposes an endpoint that returns activity log entries but does not consistently verify the requester's authorization against the privacy flag of each record.

As a result, an attacker who sends crafted requests to the vulnerable endpoint receives private entries belonging to any user. No authentication, session, or user interaction is required. The exposed data can include usernames, timestamps, point balances, achievement identifiers, and other gamification metadata that reveal user behavior patterns.

This issue is explicitly described by the vendor and reporter as an incomplete fix of CVE-2026-13450. The earlier patch addressed one access path but left an equivalent code path unprotected, allowing the same class of disclosure to persist.

Root Cause

The root cause is a missing authorization check [CWE-200] in the activity log retrieval logic. The server-side handler trusts request parameters and returns matching rows without filtering based on the authenticated user's permissions or the private flag of each entry.

Attack Vector

The vulnerability is exploitable over the network with low complexity and no privileges. An attacker issues HTTP requests to the plugin's activity log endpoint on a vulnerable site and parses the response for private entries. See the WPScan Vulnerability Report for technical details on the vulnerable request pattern.

No verified public exploit code is linked in the available data; the vulnerability is described in prose by the reporting source.

Detection Methods for CVE-2026-107320

Indicators of Compromise

Unauthenticated HTTP requests targeting GamiPress activity log endpoints, particularly from a single source enumerating multiple user IDs.
Spikes in anonymous traffic to WordPress AJAX or REST routes associated with the gamipress namespace.
Web server access logs showing successful 200 responses to activity-log requests without an authenticated session cookie.

Detection Strategies

Review WordPress and web server logs for repeated requests to GamiPress activity log endpoints lacking valid wordpress_logged_in_* cookies.
Compare the installed GamiPress plugin version to 8.0.6 across all managed WordPress instances.
Correlate anonymous access to gamification endpoints with subsequent credential-stuffing or targeted phishing attempts informed by exposed user data.

Monitoring Recommendations

Enable verbose logging for WordPress REST and admin-ajax.php traffic and forward it to a centralized analytics pipeline.
Alert on anonymous requests to any gamipress-prefixed endpoint that return non-empty JSON payloads.
Track plugin inventory changes so new deployments of GamiPress are automatically assessed against the fixed version.

How to Mitigate CVE-2026-107320

Immediate Actions Required

Update GamiPress to version 8.0.6 or later on every WordPress site in the environment.
Audit WordPress plugin inventories and prioritize sites that previously received only the CVE-2026-13450 patch.
Review access logs for prior unauthenticated requests to GamiPress activity log endpoints and treat exposed user data as disclosed.

Patch Information

The vendor has released GamiPress 8.0.6, which fully enforces authorization on private activity log retrieval. This release supersedes the incomplete fix shipped for CVE-2026-13450. Refer to the WPScan Vulnerability Report for version confirmation.

Workarounds

Restrict access to GamiPress activity log endpoints at the web application firewall by requiring an authenticated WordPress session cookie.
Temporarily disable the GamiPress plugin on sites that cannot be upgraded immediately.
Block anonymous requests to admin-ajax.php and REST routes containing the gamipress keyword until the plugin is patched.

bash

# Example WAF rule (ModSecurity) to block unauthenticated access to GamiPress activity log endpoints
SecRule REQUEST_URI "@rx (?i)(admin-ajax\.php|wp-json\/gamipress).*activity.*log" \
    "id:1072026,\
     phase:1,\
     deny,\
     status:403,\
     chain,\
     msg:'Block unauthenticated access to GamiPress activity log (CVE-2026-107320)'"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"