GamiPress WordPress Plugin Arbitrary Shortcode Execution Vulnerability

A vulnerability exists in the GamiPress WordPress plugin, specifically in versions through 7.2.1, allowing for arbitrary shortcode execution. This issue arises in the gamipress_ajax_get_logs() function, where user-supplied values are not properly validated before being processed by do_shortcode. As a result, unauthenticated users can execute arbitrary shortcodes on the site.

Impact

Exploitation of this vulnerability allows for unauthorized users to execute arbitrary shortcodes, which could lead to various impacts depending on the executed shortcode.

Remediation

Users can update to GamiPress version 7.2.2 or later to address this vulnerability.