CVE-2026-107320 in GamiPress Plugin
Summary
by MITRE • 10/14/2026
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The GamiPress WordPress plugin version 8.0.6 and earlier contains a critical authorization flaw that allows unauthenticated attackers to access sensitive user data through the private activity log feature. This vulnerability represents an incomplete remediation of CVE-2026-13450, indicating that previous security patches failed to fully address the underlying authentication logic within the plugin's administrative endpoints. The core issue stems from a failure in server-side access control checks when handling requests for user-specific activity logs. Instead of verifying whether the requesting user possesses the necessary administrator privileges or ownership rights over the specific log entries being requested, the application processes these queries without adequate validation. This oversight permits any individual with network connectivity to the WordPress installation to retrieve detailed records of private activities performed by all users on the site.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control and aligns with MITRE ATT&CK technique T1078 Valid Accounts or potentially T1539 Steal Web Session Cookie if session tokens are also compromised during enumeration. The flaw typically manifests in AJAX handlers or REST API endpoints that expose user activity data without enforcing strict role-based access control mechanisms. Attackers can exploit this by crafting specific HTTP requests to the plugin's internal APIs, bypassing standard WordPress authentication checks due to misconfigured nonce verification or missing capability checks such as current_user_can with appropriate capabilities like manage_options or edit_users. The result is a complete breakdown of confidentiality for user activity data, which may include login timestamps, action types, IP addresses, and other metadata that can be used for further reconnaissance or social engineering attacks.
The operational impact of this vulnerability extends beyond simple data leakage. Private activity logs often contain sensitive information about administrative actions, password changes, permission modifications, and content edits. Exposure of this data allows attackers to map out the internal structure of a WordPress installation, identify high-value targets such as administrators, and understand security policies in place. This intelligence can facilitate more sophisticated attacks including privilege escalation, targeted phishing campaigns against identified users, or planning for further exploitation based on observed administrative behaviors. In environments where compliance with standards like GDPR or HIPAA is required, this vulnerability also constitutes a significant data breach incident due to the unauthorized disclosure of personal and operational information.
Mitigation strategies must prioritize immediate patching and defensive configuration changes. The most effective solution is to upgrade GamiPress to version 8.0.6 or later where the authorization logic has been properly corrected to enforce strict access controls on all activity log endpoints. For sites unable to update immediately, administrators should consider disabling the public-facing aspects of the plugin if not needed and ensuring that WordPress user roles are tightly restricted. Implementing a Web Application Firewall can also help by blocking known exploit patterns associated with unauthorized API calls to GamiPress endpoints. Additionally, monitoring server logs for unusual access patterns to activity log URLs can aid in early detection of exploitation attempts while permanent fixes are deployed. Regular security audits and penetration testing should be conducted to ensure that similar authorization flaws do not persist in other plugins or custom code within the WordPress ecosystem.