Skip to content
Sign in
4.3 Medium

CVE-2026-77764 The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality,…

Description

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.

Affected products and versions

Product Affected versions Fixed in
GamiPress 7.9 earliest → < 7.9.9.6 7.9.9.6

Other CVEs of GamiPress

The 6 CVEs of GamiPress →
CVE-2026-107320 The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries,… 5.3 Medium CVE-2026-107319 The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its… 4.3 Medium CVE-2024-8245 The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could… 4.3 Medium CVE-2024-2505 The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its… 8.1 High
Track this CVE