PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107320 GamiPress CVE debrief

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This vulnerability affects WordPress installations with the GamiPress plugin, particularly versions 7.9.5 to 8.0.5. Defenders should assess exposure and potential impact, focusing on verifying the version of GamiPress and updating to 8.0.6 or later if necessary. The vulnerability allows unauthorized access to private activity logs, potentially exposing sensitive information.

Vendor
GamiPress
Product
GamiPress
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-14
Original CVE updated
2026-10-14
Advisory published
2026-10-14
Advisory updated
2026-10-14

Who should care

Defenders responsible for WordPress installations with the GamiPress plugin should assess exposure and potential impact. This includes administrators, security teams, and IT personnel managing WordPress environments with GamiPress versions 7.9.5 to 8.0.5. They should verify the version of GamiPress and update to 8.0.6 or later if necessary. Additionally, they should monitor for potential unauthorized access toprivate

Why it matters

Defenders should prioritize verifying exposure of GamiPress versions 7.9.5 to 8.0.5 and assessing the potential impact of unauthenticated private activity log disclosure.

  • Potential unauthorized access to private activity logs
  • Possible exposure of sensitive information

Technical summary

The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries. This allows unauthenticated users to retrieve the private activity logs of all users. The vulnerability is due to insufficient access control mechanisms in the plugin. Affected versions include 7.9.5 to 8.0.5. Defenders should prioritize verifying exposure of these versions and assessing the potential impact of unauthenticated private activity log disclosure.

Defensive priority

Defenders should prioritize verifying exposure of GamiPress versions 7.9.5 to 8.0.5 and assessing the potential impact of unauthenticated private activity log disclosure.

Recommended defensive actions

  • Verify GamiPress version and update to 8.0.6 or later if necessary
  • Assess exposure of GamiPress versions 7.9.5 to 8.0.5
  • Monitor for potential unauthorized access to private activity logs

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from vendors or other sources may be necessary to fully understand the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107320 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107320

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107320 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107320

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.