CVE-2026-13450: GamiPress WordPress IDOR Vulnerability

CVE-2026-13450 Overview

CVE-2026-13450 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the GamiPress gamification plugin for WordPress in all versions up to and including 7.9.4. The flaw resides in the access parameter, which lacks validation on a user-controlled key. Unauthenticated attackers can view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plugins such as WooCommerce, LearnDash, and BuddyPress. The gamipress nonce that normally gates the request is broadcast to all front-end visitors through wp_localize_script on the wp_enqueue_scripts hook, making the authentication barrier trivial to bypass. The issue is tracked under [CWE-639].

Critical Impact
Any unauthenticated visitor can enumerate private activity logs across every GamiPress user, exposing engagement data, purchase-related events, and learning activity from integrated plugins.

Affected Products

GamiPress WordPress plugin versions 7.9.4 and earlier
GamiPress deployments integrated with WooCommerce, LearnDash, and BuddyPress
WordPress sites exposing the gamipress_logs shortcode or AJAX endpoints

Discovery Timeline

2026-07-09 - CVE-2026-13450 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-13450

Vulnerability Analysis

GamiPress exposes an AJAX endpoint used by the gamipress_logs shortcode to render activity feeds. The endpoint accepts an access parameter that specifies whose logs the request may view. The server does not validate whether the requesting user is authorized to view the target user's logs, so any attacker can supply an arbitrary user identifier and retrieve their private log entries.

GamiPress hardens the endpoint with a nonce named gamipress, but the plugin registers that nonce through wp_localize_script on the wp_enqueue_scripts hook. That hook runs for every front-end request, including anonymous ones, so the nonce ships to any visitor who loads a page where GamiPress scripts are enqueued.

Exploitation results in disclosure of gamification activity data: badges earned, points balances, purchase-driven events from WooCommerce, course activity from LearnDash, and social interactions from BuddyPress. Confidentiality is affected while integrity and availability are not.

Root Cause

The root cause is missing authorization on a user-controlled key. The AJAX handler trusts the access parameter without confirming that the current session owns the referenced user identifier or has a capability that permits reading another user's logs. Compounding the issue, the sole gating control — the gamipress nonce — is not bound to a privileged context and is emitted to unauthenticated visitors.

Attack Vector

An attacker loads any public page on the target site that enqueues GamiPress scripts and extracts the localized gamipress nonce from the page source. The attacker then issues an AJAX request to the GamiPress logs endpoint with the harvested nonce and an access value referencing the victim user identifier. The server returns the requested log entries. The workflow requires no authentication, no user interaction, and low attack complexity. Technical details are documented in the Wordfence Vulnerability Report and referenced in the GamiPress AJAX Functions Code and GamiPress Logs Shortcode Code.

Detection Methods for CVE-2026-13450

Indicators of Compromise

Repeated POST requests to admin-ajax.php with action=gamipress_get_logs or similar GamiPress log actions from a single source enumerating sequential user IDs
Requests supplying an access parameter whose value does not match the requester's session user
Anomalous spikes in unauthenticated traffic to pages containing the [gamipress_logs] shortcode

Detection Strategies

Inspect WordPress access logs for AJAX calls to GamiPress log actions containing an access parameter and correlate the source IP with authentication state
Alert on unauthenticated clients iterating user IDs against the GamiPress AJAX endpoint within short time windows
Compare the plugin version reported by WordPress against the fixed baseline and flag any host still running 7.9.4 or earlier

Monitoring Recommendations

Route WordPress and web server logs into a central analytics pipeline and build dashboards for GamiPress AJAX activity
Track outbound response sizes for GamiPress log endpoints; large or bulk responses to unauthenticated sessions warrant investigation
Enable a web application firewall (WAF) rule set that inspects the access parameter and blocks cross-user references

How to Mitigate CVE-2026-13450

Immediate Actions Required

Update the GamiPress plugin to a version later than 7.9.4 that includes the fix referenced in the GamiPress Changeset Update
Audit WordPress access logs for prior exploitation attempts against GamiPress AJAX actions since the plugin was installed
Review published pages and templates for the [gamipress_logs] shortcode and remove it from anonymous-facing surfaces where feasible

Patch Information

The GamiPress maintainers addressed the flaw in the release following 7.9.4. The vendor changeset applies validation to the access parameter and restricts log retrieval to authorized requesters. Site operators should upgrade through the WordPress plugin manager or by deploying the vendor package directly. Confirm the installed version after the update and clear any caching layers that may retain the vulnerable AJAX responses.

Workarounds

Deploy a WAF rule that blocks unauthenticated admin-ajax.php requests referencing GamiPress log actions with a non-matching access value
Restrict access to admin-ajax.php for GamiPress log actions using web server rules until the patch is deployed
Temporarily disable the GamiPress plugin on sites that cannot upgrade immediately and do not depend on active gamification features

bash

# Example nginx rule to block unauthenticated GamiPress log AJAX calls
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "^gamipress_get_logs") {
        set $block "1";
    }
    if ($http_cookie !~* "wordpress_logged_in_") {
        set $block "${block}1";
    }
    if ($block = "11") {
        return 403;
    }
}