The GamiPress WordPress plugin before version 8.0.6 fails to enforce a capability check on an authenticated AJAX action. This oversight allows any logged‑in user, even those with only a Subscriber role, to retrieve the activity log. The exposed log includes other users’ point balances, earned achievements, and the usernames of administrators who performed manual point awards or revocations, constituting an information disclosure vulnerability.

WordPress sites that have installed the GamiPress plugin with a release earlier than 8.0.6. Any authenticated user on such sites, regardless of role, can exploit the vulnerable AJAX endpoint to read sensitive activity log data.

With a CVSS score of 4.3 and an EPSS score below one percent, the likelihood of exploitation is considered low. The vulnerability requires only valid authenticated credentials and does not grant code execution or alter system integrity, but it does expose confidential user data such as points balances and administrator identities. The vulnerability is not listed in CISA KEV.