CVE-2025-13812

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the gamipress_ajax_get_posts and gamipress_ajax_get_users functions in all versions up to, and including, 7.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate users, including their email addresses and to retrieve titles of private posts.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jan 6, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-138138.1A vulnerability was identified in moxi159753 Mogu Blog v2 up to 5.2. This issue affects some unknown processing of the file /storage/ of the CVE-2025-138149.8A security flaw has been discovered in moxi159753 Mogu Blog v2 up to 5.2. Impacted is the function LocalFileServiceImpl.uploadPictureByUrl o CVE-2025-138159.8A weakness has been identified in moxi159753 Mogu Blog v2 up to 5.2. The affected element is an unknown function of the file /file/pictures.CVE-2025-138168.8A security vulnerability has been detected in moxi159753 Mogu Blog v2 up to 5.2. The impacted element is the function FileOperation.unzip of CVE-2025-138186.7Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent CVE-2025-138196.1Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external w CVE-2025-13826.1The Contact Us By Lord Linus WordPress plugin through 2.6 does not have CSRF check in some places, and is missing sanitisation as well as es CVE-2025-138205.3The Comments WordPress plugin before 7.6.40 does not properly validate user's identity when using the disqus.com provider, allowing an atta CVE-2025-138215.7Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to sanitize sensitive data in WebSocket messages which allow CVE-2025-138225.3MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allow CVE-2025-138237.1A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packe CVE-2025-138248.7A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red