PT-2026-1420 · WordPress · Gamipress

Kenneth Dunn · Publicado 2026-01-06 · Atualizado 2026-01-06 · CVE-2025-13812

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GamiPress – Gamification plugin for WordPress versions prior to 7.6.2

Description The GamiPress – Gamification plugin for WordPress is susceptible to unauthorized data access. A missing capability check in the gamipress ajax get posts and gamipress ajax get users functions allows authenticated attackers with Subscriber-level access or higher to enumerate users, including their email addresses, and retrieve titles of private posts.

Recommendations Update to version 7.6.2 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-13812

Produtos afetados

Gamipress

Referências · 7

• https://t.me/CVEtracker/41485 · Publicação no Telegram
• https://t.me/cveNotify/147809 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2008463833480728647 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-13812 · Nota de Segurança
• https://twitter.com/CVEnew/status/2008445251707343221 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/acfdd579-0be9-476b-90cd-07f417712691?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3430697 · Nota