GamiPress WordPress Plugin Missing Authorization Vulnerability Allows Data Exposure

A vulnerability exists in the GamiPress WordPress plugin, specifically in the gamipress_ajax_get_posts and gamipress_ajax_get_users functions, all versions through 7.6.1. The issue arises from a missing capability check, which enables authenticated attackers with Subscriber-level access and above to access unauthorized data. This vulnerability allows for the enumeration of users along with their email addresses and the retrieval of titles from private posts.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user data, including email addresses, and private post titles.

Remediation

Users are advised to update the GamiPress WordPress plugin to version 7.6.2 or a newer patched version.