Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

GamiPress plugin lets anyone view private activity logs

CVE-2026-107320 · published 21 days ago
Summary

The GamiPress add‑on for WordPress does not check who is asking for private activity records, so anyone on the internet can see the hidden activity history of all users. This could reveal sensitive information about user actions on your site. Update the plugin to version 8.0.6 or later, or temporarily restrict access to the log until you can apply the fix.

What to do
  • Update unknown gamipress to version 8.0.6 or later.
Affected software
VendorProductAffected versions
unknown gamipress < 8.0.6
Original advisory text
GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure
The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs of all users. This is an incomplete fix of CVE-2026-13450.
References
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-107320 · NVD
CVE-2026-107320 · MITRE
Track software like this
Free during beta