Description
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | GamiPress | < 7.9.9.6 | 7.9.9.6 |
References
- https://wpscan.com/vulnerability/c272dadd-9fc9-402f-8712-51d16a271e4b/ exploit vdb-entry technical-description