A missing authorization check in the GamiPress WordPress plugin allows an attacker to bypass intended access controls and exploit incorrectly configured security levels, potentially accessing or manipulating data and actions that should be restricted. The flaw does not grant arbitrary code execution but enables unauthorized use of plugin features that could expose sensitive information or facilitate further privilege escalation within the site. The weakness is a classic example of missing permissions verification, identified as CWE-862.

All installations of the Ruben Garcia GamiPress plugin version 7.6.3 or older are affected. The issue applies to any WordPress site that has not updated beyond 7.6.3, regardless of the WordPress core version, as the vulnerability is tied solely to the plugin package.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of widespread exploitation. The likely attack vector is through the WordPress administrative interface or through authenticated requests crafted by a user with sufficient privileges; an attacker would need some level of access or the ability to send crafted requests to trigger the vulnerable functionality. Given the moderate score and lack of public exploits, the overall risk is considered low to moderate, yet sites that rely on the plugin’s functionality should remediate promptly.