WordPress GamiPress plugin <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings vulnerability

Unauthenticated Arbitrary Shortcode Execution via gamipressgetuserearnings vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin GamiPress versions = 7.1.5...

PT-2024-16720

Name of the Vulnerable Software and Affected Versions GamiPress versions up to, and including, 7.1.5 Description The issue allows arbitrary shortcode execution via the gamipress get user earnings AJAX action. This is due to the software allowing users to execute an action that does not properly...