CVE-2026-77764: unknown gamipress
Vulnerability summary
CVE-2026-77764 is a medium (CVSS 4.3) vulnerability in unknown gamipress. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.9% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 7.9.9.6.
Timeline
- 02-09-2026PublishedVulnerability first disclosed.
- 02-09-2026Last modifiedVulnerability information updated.
Description
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
+0.07 pp
From 0.18% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Unknown1 product
- gamipress< 7.9.9.6
Wordpress1 product
- gamipress< 7.9.9.6
2 vendors · 2 products