CVE-2026-77764 — GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners

CVE-2026-77764

GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners PUBLISHED

Description (CNA)

The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them without limit.

Affected (CNA)

Vendor / product	Versions
Unknown / GamiPress	affected 0 before 7.9.9.6

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c272dadd-9fc9-402f-8712-51d16a271e4b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.