High severity7.3NVD Advisory· Published Jan 22, 2025· Updated Jun 17, 2026

CVE-2024-13495

Description

The The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via the gamipress_ajax_get_logs() function in all versions up to, and including, 7.2.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Gamipress/Gamipress
cpe:2.3:a:gamipress:gamipress:*:*:*:*:*:wordpress:*:*
Range: <7.2.2
WordPress/Gamipressllm-fuzzy2 versions
<=7.2.1+ 1 more
- (no CPE)range: <=7.2.1
- (no CPE)
Package: https://wordpress.org/plugins/gamipress
rubengc/GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPressv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3226227/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/55fa8423-9a41-4afe-9401-03d232caa656nvdThird Party Advisory
plugins.trac.wordpress.org/browser/gamipress/trunk/includes/ajax-functions.phpnvdProduct
wordpress.org/plugins/gamipress/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.474
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000