// For flags

CVE-2024-11036

GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings

Severity Score

7.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

El complemento The GamiPress – The #1 gamification plugin to reward points, achievements, badges &amp; ranks in WordPress para WordPress es vulnerable a la ejecución de códigos cortos arbitrarios a través de la acción AJAX gamipress_get_user_earnings en todas las versiones hasta la 7.1.5 incluida. Esto se debe a que el software permite a los usuarios ejecutar una acción que no valida correctamente un valor antes de ejecutar do_shortcode. Esto hace posible que atacantes no autenticados ejecuten códigos cortos arbitrarios.

*Credits: Arkadiusz Hydzik
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-11-08 CVE Reserved
  • 2024-11-18 CVE Published
  • 2024-11-19 CVE Updated
  • 2024-11-20 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Rubengc
Search vendor "Rubengc"
 GamiPress – The #1 Gamification Plugin To Reward Points, Achievements, Badges & Ranks In WordPress
Search vendor "Rubengc" for product "GamiPress – The #1 Gamification Plugin To Reward Points, Achievements, Badges & Ranks In WordPress"
 <= 7.1.5
Search vendor "Rubengc" for product "GamiPress – The #1 Gamification Plugin To Reward Points, Achievements, Badges & Ranks In WordPress" and version " <= 7.1.5"
en
Affected