CVE-2026-77764

4.3 mediumEPSS 0.3%

Medium (4.3). EPSS 0.3% chance of exploitation in the next 30 days.

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.

Severity

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-11-01)
CWE: CWE-639
Published: 2026-09-02
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/c272dadd-9fc9-402f-8712-51d16a271e4b/

Check your stack JSON