CVE-2024-13495: 
WordPress vulnerability analysis and mitigation

The GamiPress WordPress plugin (versions up to 7.2.1) contains a vulnerability (CVE-2024-13495) that allows unauthenticated attackers to execute arbitrary shortcodes. The vulnerability was discovered in January 2025 and affects the gamipress_ajax_get_logs() function, which fails to properly validate values before executing do_shortcode (Wordfence Advisory, NVD).

The vulnerability exists in the gamipress_ajax_get_logs() function where input validation is insufficient before executing the do_shortcode function. This vulnerability has been assigned a CVSS v3.1 base score of 7.3 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The weakness is classified as CWE-94 (Improper Control of Generation of Code) (NVD).

The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes on affected WordPress installations. This could potentially lead to unauthorized access to sensitive information, modification of content, and other security implications (NVD).

The vulnerability is exploitable by unauthenticated attackers and requires no user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (Wordfence Advisory).

The vulnerability has been patched in version 7.2.2 of the GamiPress plugin. Site administrators are strongly advised to update to this version or later to protect against potential attacks (WordPress Plugin).