Description

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T06:17:17.367Z",
  "pubdate": "2026-09-02T06:17:17.367Z",
  "executiveSummary": "The GamiPress WordPress plugin prior to version 7.9.9.6 contains a critical broken access control vulnerability within its video watch-tracking functionality.\nThis flaw allows low-privileged users, such as those with the Subscriber role, to interact with internal API endpoints intended only for administrative or automated triggers.\nBy manipulating requests, an attacker can illicitly award gamification points, achievements, and ranks to any arbitrary user on the platform, including administrators.\nFurthermore, the absence of rate limiting or proper authorization checks allows for the systematic abuse of the points-awarding mechanism.\nThe vulnerability poses a significant risk to the integrity of the gamification ecosystem, potentially leading to unauthorized privilege escalation or the manipulation of platform-specific metrics.\nExploitation requires active authentication as a registered user, but does not necessitate elevated privileges, making it accessible to any malicious actor with a standard account.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient authorization controls within the video watch-tracking component of the GamiPress plugin.\nThe root cause is the failure of the application to verify that the user triggering the points-award event has the legitimate authority to modify the gamification state for a target user ID.\nThe affected component fails to implement server-side validation of the 'user_id' parameter in requests directed at the tracking endpoint, allowing for the injection of arbitrary user IDs.\nAttack flow begins with a authenticated user identifying the POST request responsible for logging video progress and triggering associated points. Instead of restricting this request to valid video playback sessions, the backend accepts the request and processes the reward logic based on the user-provided parameters.\nAn attacker can intercept this traffic using a proxy tool, modifying the target user ID to that of an administrator or another user, and replaying the request multiple times.\nBecause the system lacks nonce verification or per-session state tracking, an attacker can bypass the intended logic to award an unlimited number of points or achievements.\nThis vulnerability is classified as an Insecure Direct Object Reference (IDOR) coupled with a missing access control check on a functional endpoint.\nThe scope of impact is platform-wide: if an attacker can correlate gamification ranks with internal system permissions or use them to bypass other plugin-based restrictions, the security of the WordPress installation is significantly compromised.\nThere is no requirement for administrative interaction; the exploit is fully executable by any authenticated subscriber via standard HTTP requests to the public-facing site."
}