CVE-2026-107319 GamiPress CVE debrief

Who should care

WordPress site administrators using the GamiPress plugin should verify the version installed and update to 8.0.6 or later to prevent unauthorized access to activity logs. This is crucial for maintaining the security and integrity of their sites, especially considering the potential for exposure of sensitive information through activity log entries.

Why it matters

The GamiPress WordPress plugin vulnerability allows subscribers to read arbitrary activity log entries, potentially exposing sensitive information. Defenders should prioritize verifying the version of GamiPress installed and update to 8.0.6 or later.

• Potential unauthorized access to activity logs
• Possible exposure of sensitive information
• Need for verification of GamiPress version and update to 8.0.6 or later
• Monitoring of activity logs for suspicious activity

Technical summary

The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions. This vulnerability allows unauthorized access to sensitive information, emphasizing the need for defenders to verify the version of GamiPress installed and update to 8.0.6 or later.

Defensive priority

Defenders should prioritize verifying the version of GamiPress installed on their WordPress sites and update to version 8.0.6 or later to prevent unauthorized access to activity logs.

Recommended defensive actions

• Verify the version of GamiPress installed on WordPress sites
• Update GamiPress to version 8.0.6 or later
• Monitor activity logs for unauthorized access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on the potential impact and affected versions. Defenders should verify the version of GamiPress installed and review activity logs for potential unauthorized access. The vulnerability allows subscribers to read arbitrary activity log entries, potentially exposing sensitive information. Evidence is limited, and further verification is necessary to determine the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.