GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress, CVE-2024-13499

CVE, Research URL: CVE-2024-13499
Home page URL: Security reports for GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Application: GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress
Published on: Jan 22, 2025
Research Description: The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_do_shortcode() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Affected versions: Min -, max 7.2.2.
Status: vulnerable

GamiPress &#8211; The #1 gamification plugin to reward points, achievements, badges &amp; ranks in WordPress, CVE-2024-13499