GamiPress WordPress Plugin Activity Log IDOR Vulnerability
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.9.4 via the 'access' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to view private GamiPress activity log entries belonging to any user, including badge earnings, points balance changes, and event records from integrated plugins such as WooCommerce, LearnDash, and BuddyPress. This is exploitable by any unauthenticated visitor because the required 'gamipress' nonce is broadcast to all front-end users via wp_localize_script on the wp_enqueue_scripts hook, making the sole authentication barrier trivially bypassable.
Browse WordPress security risksQuick answer
GamiPress should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- GamiPress up to and including 7.9.4
Fixed versions
- Apply the latest vendor-supported patched version.
How to fix it
GamiPress is affected by CVE-2026-13450. Versions up to 7.9.4 allow insecure direct object reference behavior: unauthenticated attackers can view private activity log entries by abusing a user-controlled access key. Patch the plugin and audit exposed private records.
- Inventory WordPress sites using GamiPress.
- Update GamiPress beyond 7.9.4 when a fixed release is available.
- Disable or restrict the affected front-end/API feature until patched.
- Review public nonces and endpoints that expose object IDs or access keys.
- Audit activity logs and sensitive records for enumeration or unauthorized access.
- Restrict low-privilege or unauthenticated access to affected plugin routes with WAF rules.
- Clear caches after patching to remove stale public JavaScript data.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm GamiPress is no longer version 7.9.4 or older.
- Attempt a safe object-ID substitution test in staging and confirm unauthorized records are denied.
- Confirm legitimate users can still access only their own permitted records.
- Review logs for continued enumeration attempts after mitigation.
- Run a Fixnx scan and confirm public WordPress exposure is rechecked.
Related categories
Related security risks
More published guidance from the same primary category.
Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Updated July 24, 2026
mediumParticipants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
Updated July 24, 2026
highWPify Woo <= 5.4.16 - Authenticated (Shop Manager+) Privilege Escalation via Arbitrary Option Update via save_option REST Endpoint
Updated July 24, 2026
Trusted references
FAQ
What is affected by CVE-2026-13450?
GamiPress versions listed as affected should be reviewed: GamiPress up to and including 7.9.4.
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.