WordPress Plugin Vulnerabilities

GamiPress < 7.6.7 - Cross-Site Request Forgery

Description

The GamiPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.6.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
gamipress
Fixed in 7.6.7

References

CVE
CVE-2026-32420
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2d7be70b-ac33-4fc2-a627-52f238c2011e

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
LAKSHMIKANTHAN K (letchupkt)
Verified
No
WPVDB ID
fa9d4ac1-cebb-40bb-b297-c4a474202acb

Timeline

Publicly Published
2026-02-26 (about 3 months ago)
Added
2026-04-15 (about 1 month ago)
Last Updated
2026-04-15 (about 1 month ago)

Other

Published
Title
Published
2024-07-02
Title
Snippet Shortcodes < 4.1.5 - Cross-Site Request Forgery
Published
2025-11-03
Title
SH Contextual Help <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2026-04-14
Title
Inquiry form to posts or pages <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter
Published
2024-11-13
Title
wp-login customizer <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2022-06-27
Title
Insights from Google PageSpeed < 4.0.7 - Multiple CSRF