GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress, CVE-2024-11036

CVE, Research URL: CVE-2024-11036
Home page URL: Security reports for GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Application: GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Published on: Nov 19, 2024
Research Description: The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected versions: Min -, max 7.1.6.
Status: vulnerable

GamiPress &#8211; The #1 gamification plugin to reward points, achievements, badges &amp; ranks in WordPress, CVE-2024-11036