CVE-2024-11036

HIGH

GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-11036 has a selected CVSS score of 7.3 (high).

Description

The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 19, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

gamipress

Browse gamipress / gamipress

Default status: unaffected

CVE ListThrough 7.1.5affected

GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

Browse rubengc / GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress

Default status: unaffected

CVE ListThrough 7.1.5affected

References

5