The vulnerability exists in GamiPress versions 7.9.5 through 8.0.5. It allows an unauthenticated user to access the private activity log entries for all site users because the plugin fails to enforce proper authorization on that endpoint. While it does not provide code execution or modify site state, the exposed logs can reveal sensitive user actions, potentially allowing attackers to glean privileged activity information, facilitate social engineering, and comply with privacy regulations. The weakness is a classic authorization bypass that permits information disclosure beyond the intended audience.

WordPress sites that have the GamiPress plugin installed, specifically versions 7.9.5 up to, but not including, 8.0.6. All users of the site are affected because the private logs are accessible to anyone who can reach the vulnerable endpoint. The plugin is distributed under the name GamiPress with no additional vendor identifiers reported.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation probability under current threat intelligence. The attack vector is likely an unauthenticated HTTP request to the plugin’s log endpoint, which does not require credentials or special privilege. There is no known requirement for user interaction beyond viewing the logs, thereby making this a low‑fidelity but potentially damaging exposure for affected sites.