An unauthorized data exposure flaw was discovered in the WordPress GamiPress plugin. The plugin's gamipress_ajax_get_posts and gamipress_ajax_get_users AJAX callbacks lack a required capability check, allowing an authenticated user with a Subscriber role or higher to retrieve sensitive information. An attacker can enumerate all registered users, obtain their email addresses, and view the titles of private posts, thereby exposing non‑public data.

The vulnerability impacts all installations of the GamiPress plugin version 7.6.1 and earlier when running within a WordPress environment. Any site that has the plugin activated and has not yet upgraded beyond 7.6.1 is affected.

The CVSS score of 4.3 denotes moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers need only possess valid credentials for a user role with Subscriber privileges or higher, then they can simply send AJAX requests to the exposed endpoints to obtain user lists and private post titles. No additional privileges are required beyond the authenticated session, making the threat vector accessible to any authenticated user on the site.