CVE-2024-2505: high-severity vulnerability in GamiPress
GamiPress < 6.8.9 - Broken Access Control
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.6%
exploitation probability
0.6%top 51% of all CVEs
observed exploitation
nono source reports it
The GamiPress WordPress plugin before 6.8.9's access control mechanism fails to properly restrict access to its settings, permitting Authors to manipulate requests and extend access to lower privileged users, like Subscribers, despite initial settings prohibiting such access. This vulnerability resembles broken access control, enabling unauthorized users to modify critical GamiPress WordPress plugin before 6.8.9 configurations.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Unknown · GamiPressRelated CVEs — GamiPress
In the same product, most dangerous first.
CVE-2023-0154MEDIUMGamiPress – Vimeo integration < 1.0.9 - Contributor+ Stored XSSEPSS 0.7%CVE-2026-77764MEDIUMGamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video ListenersEPSS 0.3%CVE-2024-8245MEDIUMGamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRFEPSS 0.2%