---
id: CVE-2026-107319
title: >-
  The GamiPress  WordPress plugin before 8.0.6 does not perform a capability
  check or ownership verification on one of its authenticated AJAX actions,
  allowing any authenticated user, such as a Subscriber, to read arbitrary
  entries from it…
summary: >-
  The GamiPress  WordPress plugin before 8.0.6 does not perform a capability
  check or ownership verification on one of its authenticated AJAX actions,
  allowing any authenticated user, such as a Subscriber, to read arbitrary
  entries from it…
severity: none
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:17:01.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-107319'
references:
  - url: 'https://wpscan.com/vulnerability/a5ab2959-a7ba-4b62-8f5e-d2527ffeb1bd/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-14T07:21:04.838Z'
---

## Overview

The GamiPress  WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, including other users' points balances and earned achievements and the usernames of the administrators who performed manual point award and revoke actions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.