The vulnerability is a Cross‑Site Request Forgery flaw in the GamiPress WordPress plugin. It allows an attacker to trick a legitimate user into executing unwanted actions within the plugin that the user’s browser is authenticated to. The impact is that the attacker can perform privileged operations such as awarding points, adding badges, or modifying the user’s account settings without the user’s consent. This weakness is identified as CWE-352, indicating an attacker can exploit the lack of CSRF protection to gain unauthorized use of functionalities that rely on authenticated sessions.

The affected product is the GamiPress plugin for WordPress, developed by Ruben Garcia. All versions of the plugin from the earliest releases up to and including 7.6.6 are affected. WordPress sites that have not updated the plugin beyond version 7.6.6 are at risk.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is less than 1%, implying low current exploitation probability. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, which suggests no known public exploitation yet. Likely attack vectors involve a malicious link or email that forces the user’s browser to submit a forged request to the GamiPress endpoint. An attacker would need a user with sufficient privileges or an authenticated session to succeed, but the lack of CSRF tokens permits the forgery.