High severity7.3NVD Advisory· Published Nov 19, 2024· Updated Jun 17, 2026
CVE-2024-11036
CVE-2024-11036
Description
The The GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via gamipress_get_user_earnings AJAX action in all versions up to, and including, 7.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4<=7.1.5+ 1 more
- (no CPE)range: <=7.1.5
- (no CPE)
- rubengc/GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPressv5Range: 0
Patches
Vulnerability mechanics
References
5- www.wordfence.com/threat-intel/vulnerabilities/id/bad0cd3f-88ea-4a1d-b400-0a450b07a546nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/gamipress/nvdProduct
- plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.phpnvdProduct
- plugins.trac.wordpress.org/browser/gamipress/tags/7.1.4/includes/functions.phpnvdProduct
- wordpress.org/plugins/gamipress/nvdProduct
News mentions
0No linked articles in our index yet.